Trojan.NSIS.Sod.cup (file analysis)

The Trojan.NSIS.Sod.cup is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.NSIS.Sod.cup virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Compression (or decompression)
Creates RWX memory
Reads data out of its own binary image
Performs some HTTP requests
Executed a process and injected code into it, probably while unpacking
Network activity detected but not expressed in API logs
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

edgedl.me.gvt1.com

update.googleapis.com

How to determine Trojan.NSIS.Sod.cup?


File Info:
crc32: F3AB648A
md5: 9d1924b5b5a47ab7caa69e4164b5a2f2
name: 9D1924B5B5A47AB7CAA69E4164B5A2F2.mlw
sha1: 0f55233600b27bdc86f4d354a04d3562f4c679a2
sha256: 2c16b64d03434aabfd4d21f9ffee6bd9f7854c716d414759e0de7dfcacf4386e
sha512: 75a3505ef8f5c8f7313f72e129cb36ac99bb5c53a3b74c8d3fcf645fbecd91d544dbcb8c72f6943086119ee0d6a042f9642fe65a846dc65861497e2d908a14a9
ssdeep: 12288:qntD3aVM0Mj1fIslerekwpjmOFIwPDcfPnhUEJmUj8h:mj0MhRIYeowsDcfPhUwmUjO
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
0: [No Data]

Trojan.NSIS.Sod.cup also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.NSIS.Sod.4!c
DrWeb	Trojan.Encoder.761
CAT-QuickHeal	Ransom.Cerber.A
ALYac	Trojan.Ransom.cryptolocker
Cylance	Unsafe
Zillya	Trojan.Sod.Win32.61
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
Alibaba	Ransom:Win32/Enestedel.7d912741
K7GW	Trojan ( 004e24c81 )
K7AntiVirus	Trojan ( 004e24c81 )
Cyren	W32/Filecoder.FRJV-4194
ESET-NOD32	Win32/Filecoder.TorrentLocker.A
Zoner	Trojan.Win32.54137
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	Trojan.NSIS.Sod.cup
BitDefender	Trojan.GenericKD.4285525
NANO-Antivirus	Trojan.Win32.DKOE.eopobh
ViRobot	Trojan.Win32.Z.Agent.430418
MicroWorld-eScan	Trojan.GenericKD.4285525
Tencent	Nsis.Trojan.Sod.Htvt
Ad-Aware	Trojan.GenericKD.4285525
Sophos	Mal/Generic-R + Mal/Cerber-Z
Comodo	Malware@#11csohmgfljp0
F-Secure	Trojan.TR/Dropper.vrxqo
BitDefenderTheta	Gen:NN.ZedlaF.34088.dq4@aWQy7Vk
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_CRYPTLOCK.F117B1
McAfee-GW-Edition	W32/Teerac.b
FireEye	Generic.mg.9d1924b5b5a47ab7
Emsisoft	Trojan.GenericKD.4285525 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Nisloder.lt
Webroot	W32.Trojan.Gen
Avira	TR/Dropper.bmsgj
Antiy-AVL	Trojan/Win32.BTSGeneric
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Ransom:Win32/Teerac
Arcabit	Trojan.Generic.D416455
SUPERAntiSpyware	Ransom.CryptoLocker/Variant
ZoneAlarm	Trojan.NSIS.Sod.cup
GData	Win32.Trojan.Agent.8FQSEN
McAfee	W32/Teerac.b
MAX	malware (ai score=100)
VBA32	Trojan.Sod
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/WLT.C
TrendMicro-HouseCall	Ransom_CRYPTLOCK.F117B1
Rising	Trojan.Win32.FileCryptor.aw (CLASSIC)
Yandex	Trojan.Injector!1cIXlUU5rxE
Ikarus	Trojan.Win32.Filecoder
Fortinet	W32/InjectorGen.DLBW!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Trojan.NSIS.Sod.cup?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.NSIS.Sod.cup (file analysis)