Categories: Trojan

About “TrojanDropper:Win32/Gepys!pz” infection

The TrojanDropper:Win32/Gepys!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper:Win32/Gepys!pz virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Behavioural detection: Transacted Hollowing
CAPE detected the embedded win api malware family
Collects information to fingerprint the system
Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDropper:Win32/Gepys!pz?


File Info:
name: 0B14BA2C41FD8D02A026.mlwpath: /opt/CAPEv2/storage/binaries/5e34d6dd93089b2e577f26fa309139275d57c6a07204582c12684e5bd0fb4246crc32: A14207ACmd5: 0b14ba2c41fd8d02a026ca631ea522f7sha1: 2129a4daca010df972cd483ad881da82f9018952sha256: 5e34d6dd93089b2e577f26fa309139275d57c6a07204582c12684e5bd0fb4246sha512: 4670530bb797238f7d968e07855113976e294bc392055d007132b334c33d10a5810783907731e0358fd71ad1a22f24c0ca4810f080a7b06685500742917b0f25ssdeep: 6144:woUTxSfmV6hRRgHI6I9h/lmb5BuEw4MiQo2Rukif0nyFKotm:woxfSo60l2+CMi21iHytype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T19184EFB09090553ADA9853B44C82AC398F1EBC245AA49CD701C9FDC63FB35C587EE96Fsha3_384: f4ba69ca37c998a7bd053aad239f555844cfb1af1986517a0f53a90d7baa39b89ff9619034aba5d392fb3d3567aaa665ep_bytes: 558bec51558f0510884300a110884300timestamp: 2007-08-23 03:30:28
Version Info:
CompanyName: Euajdexwq NjyrbwbipdiFileDescription: Ehcgvuulr FlvamfDqca Hqjfh LbjtFileVersion: 6.40.8710.5980 (qcnm.096267-2946)InternalName: cscebwvo.yriLegalCopyright: © Dtycpzssm Eumwbdqhaay. Dta ivweju vsyoqaeq.OriginalFilename: swcxrpts.skaProductName: Tkyxezfzw® Kjrfcpu® Tpzjhwmfn BzfujgProductVersion: 5.71.4916.9002Translation: 0x0409 0x04b0

TrojanDropper:Win32/Gepys!pz also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Barys.57863
FireEye	Generic.mg.0b14ba2c41fd8d02
Skyhigh	Generic Malware.ms
McAfee	Generic Malware.ms
Malwarebytes	Crypt.Trojan.Malicious.DDS
Zillya	Trojan.ShipUp.Win32.16117
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.c41fd8
Baidu	Win32.Trojan.Agent.eq
VirIT	Trojan.Win32.Generic.NDT
Symantec	Packed.Generic.459
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.AXBQ
APEX	Malicious
TrendMicro-HouseCall	TROJ_AGENT_054753.TOMB
ClamAV	Win.Packed.Shipup-6840400-0
Kaspersky	Trojan.Win32.ShipUp.boh
BitDefender	Gen:Variant.Barys.57863
Avast	Win32:Gepys-J [Trj]
Tencent	Trojan.Win32.Shipup.xf
Sophos	Troj/Zbot-EHY
F-Secure	Trojan.TR/Obfuscate.adhoum
DrWeb	Trojan.Redirect.140
VIPRE	Gen:Variant.Barys.57863
TrendMicro	TROJ_AGENT_054753.TOMB
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Barys.57863 (B)
Ikarus	Trojan.Win32.ShipUp
Jiangmin	Trojan/ShipUp.jk
Google	Detected
Avira	TR/Obfuscate.adhoum
Varist	W32/Zbot.JC.gen!Eldorado
Antiy-AVL	Trojan/Win32.ShipUp
Kingsoft	malware.kb.a.1000
Microsoft	TrojanDropper:Win32/Gepys!pz
Xcitium	TrojWare.Win32.Kryptik.BVPL@57uzhp
Arcabit	Trojan.Barys.DE207
ZoneAlarm	Trojan.Win32.ShipUp.boh
GData	Win32.Trojan.PSE.C69FTW
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kuluoz.C257070
VBA32	BScope.Malware-Cryptor.Hlux
MAX	malware (ai score=87)
Cylance	unsafe
Rising	Trojan.Kryptik!1.AB8B (CLASSIC)
Yandex	Trojan.GenAsa!JtzQGDDzcuw
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.AYTK!tr
BitDefenderTheta	AI:Packer.D7547BBB1F
AVG	Win32:Gepys-J [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)