Categories: Malware

What is “VirTool:Win32/VBInject.KR”?

The VirTool:Win32/VBInject.KR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/VBInject.KR virus can do?

Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Executed a process and injected code into it, probably while unpacking
Behavioural detection: Injection (inter-process)
Created a process from a suspicious location

How to determine VirTool:Win32/VBInject.KR?


File Info:
name: 646016EC9576E5DC23D1.mlwpath: /opt/CAPEv2/storage/binaries/853c8de016183a7c87974c750f41fc5332adecbb8d35ed132204d488989f20bfcrc32: 04A2075Emd5: 646016ec9576e5dc23d1a47872ae4715sha1: 32ee26eb879838b9c634267059798c6cbe8f7300sha256: 853c8de016183a7c87974c750f41fc5332adecbb8d35ed132204d488989f20bfsha512: 55f162335e059e2c8960a06d2a86a860a7ca7223a0f000cba2862d4100b9a766a7a290aa1c6e65945c1f4b362f097fa373d0e357a234b51b4775ac7962e2fe96ssdeep: 3072:v210XDdGwDiYZD+JP/GSpxpxKAJZrY/PH9RkDVHHcpFPbGSqCJTCeCjE4lzl:v8uiEKVeG1KAJZrY/PUBHUTrVJWeYE4Ltype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B00449D65D527127F0288FB08A6906C61E7D6E6376C1ED6BAB000F45E4F47DB88F06A3sha3_384: 6c28a5388b457d7847f955755c2544ebbfa0927aa7603be0dbd828708d8783ce7062be6c1cf0e56efbcabdb3c2b9cf3aep_bytes: 68fc7a4000e8eeffffff000000000000timestamp: 2010-10-06 19:00:53
Version Info:
CompanyName: Copyright © executable fileFileDescription: Copyright © executable fileInternalName: wpwiz.exeLegalCopyright: Copyright ©   1995-2010 OriginalFilename: wp15wiz.rcProductName: Copyright © executable fileFileVersion: 6.1.33.0ProductVersion: 6.1.33.0Translation: 0x0409 0x04b0

VirTool:Win32/VBInject.KR also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Gibi.livK
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader1.26282
MicroWorld-eScan	Gen:Trojan.Heur.KS.6
FireEye	Generic.mg.646016ec9576e5dc
McAfee	Artemis!646016EC9576
Cylance	Unsafe
Zillya	Downloader.VB.Win32.26413
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	NetWorm ( 700000151 )
K7AntiVirus	NetWorm ( 700000151 )
BitDefenderTheta	AI:Packer.A56603B614
VirIT	Trojan.Win32.Generic.AFBO
Cyren	W32/VBInject.AB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.DFK
TrendMicro-HouseCall	TROJ_GEN.R002C0DLB21
Paloalto	generic.ml
ClamAV	Win.Trojan.Downloader-34051
Kaspersky	Trojan-Downloader.Win32.VB.aaup
BitDefender	Gen:Trojan.Heur.KS.6
NANO-Antivirus	Trojan.Win32.VB.decfxh
Avast	Win32:VBCrypt-BWC [Trj]
Tencent	Win32.Trojan-downloader.Vb.Wnme
Ad-Aware	Gen:Trojan.Heur.KS.6
Sophos	ML/PE-A + Mal/Rimecud-G
Comodo	Malware@#fy7vabz4jaf0
VIPRE	LooksLike.Win32.Malware!vb (v)
TrendMicro	TROJ_GEN.R002C0DLB21
McAfee-GW-Edition	BehavesLike.Win32.Fareit.cc
Emsisoft	Gen:Trojan.Heur.KS.6 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Trojan.Heur.KS.6
Jiangmin	TrojanDownloader.VB.dcoe
Avira	TR/Dropper.Gen
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Generic.ASMalwS.4C2F3
Kingsoft	Win32.TrojDownloader.VB.aa.(kcloud)
ViRobot	Trojan.Win32.A.Downloader.217088.FL
Microsoft	VirTool:Win32/VBInject.KR
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Buzus.R3767
Acronis	suspicious
VBA32	BScope.IM-Worm.Zeroll
TACHYON	Trojan-Downloader/W32.VB-Agent.188416.C
Malwarebytes	Worm.Palevo
APEX	Malicious
Rising	Dropper.Generic!8.35E (CLOUD)
Yandex	Trojan.GenAsa!KuYAvaOTuB4
Ikarus	Trojan.Win32.Ircbrute
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/VB.BZR!tr
AVG	Win32:VBCrypt-BWC [Trj]
Cybereason	malicious.c9576e
Panda	Trj/StartPage.DJQ
MaxSecure	Trojan.Malware.300983.susgen