TrojanDropper.Gepys.A (file analysis)

The TrojanDropper.Gepys.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper.Gepys.A virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Collects and encrypts information about the computer likely to send to C2 server
• Creates a hidden or system file
• Collects information to fingerprint the system

How to determine TrojanDropper.Gepys.A?

File Info:
name: E15AA2F20262425AF270.mlw
path: /opt/CAPEv2/storage/binaries/b3e20f12b3d379fe816069730ff63f8ca43a242ea8b67691635f25dea4acf1a6
crc32: B309F4FA
md5: e15aa2f20262425af270173918295490
sha1: b6452537aa4c40e576cff6c509384f2e0a945e30
sha256: b3e20f12b3d379fe816069730ff63f8ca43a242ea8b67691635f25dea4acf1a6
sha512: 691c5c9075a24550bd6cda31cdfb4ee5163733e339d88821c2f4da32c8c3030620c64116955de7d497878cd3cbdbaccdb47f8d0874fd58eb4824431668411e2e
ssdeep: 6144:3SH4NMEb+fvIAM84MnQoxXnlw/xfnj5htUBkDiVj3xMHIcxv4UTD:3SH9Eb+fvIAMnE1J4j5hyPty4UTD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19374E042BFA8A93CD85DC736E4E0D2F44E8706F6F94A9C76D0F8A583D25C8A0057C69D
sha3_384: 95fea6a2a9fb71dc7ecbe91ad9978f36222dfcb03e3ed339b99050eb67104d6f6038fa7b73f19d4e81b3cf36486e72ef
ep_bytes: 558bec81ec180200008b4d08890de827
timestamp: 2013-09-08 17:40:23

Version Info:
CompanyName: Корпорация  Майкрософт
FileDescription: Редактор личных символов
Translation: 0x0419 0x04b0

TrojanDropper.Gepys.A also known as:

How to remove TrojanDropper.Gepys.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.