Malware

Win32.Doboc.Gen.1 (B) malicious file

Malware Removal

The Win32.Doboc.Gen.1 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32.Doboc.Gen.1 (B) virus can do?

  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Code injection with CreateRemoteThread in a remote process
  • A system process is generating network traffic likely as a result of process injection
  • Behavior consistent with a dropper attempting to download the next stage.
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself

Related domains:

ulgrshox.com
rmwtobxb.info
ahcdexib.org
lwrkmpre.net
epwtcrgf.com
ufaqdfhk.info
knefczkh.org
ououiuqw.net
izwdmngt.com
yjxgefsw.info
qzkdejmv.org
ererflzg.net
clgnwvmr.com
wjivnrwk.info
evktidah.org
zdcdwgrj.net
yngzefwp.com
fpmrbcjz.info
qravohir.org
pwhomxbn.net
wzyhqhsh.com
uaknbqka.info
qjkbyfit.org
butvzdbq.net
qruhslab.com
xlcesire.info
obsnedad.org
ftiukdgh.net
inkbepax.com
ozfawaun.info
snsdkpst.org
wyeflcgx.net
cpyfwdgd.com
onqpcksb.info
mpmbedih.org
phqfkzah.net
ydovszkh.com
wagegzqo.info
itknetst.org
upszcbsj.net
gbsjmbuf.com

How to determine Win32.Doboc.Gen.1 (B)?


File Info:

crc32: 19CCCFA9
md5: 1eadef36e46316c7b121cb67b7c5a990
name: 1EADEF36E46316C7B121CB67B7C5A990.mlw
sha1: 79bc1b7b3967f949d19e682fd82b0bb1cd3d4cd1
sha256: 83beb152c4aab08865d5d17fd0384fe2b876de25a0529628ada42de36c86793a
sha512: eb3c42392880c20c12c4c6c72631ad2060a923238901f7850be7f267c20f00a010a8cd947b24a70121af66b937f11c3776696eac594380c1196e8d9dd8256b63
ssdeep: 6144:kwhBEHzWpUfPNr+DRD5fWBuxBl11tbpu2IE0O:hhB2zWSdWJZRxPP1I5O
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Win32.Doboc.Gen.1 (B) also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
DrWebTrojan.Inject1.53764
MicroWorld-eScanWin32.Doboc.Gen.1
FireEyeGeneric.mg.1eadef36e46316c7
CAT-QuickHealTrojan.Mauvaise.SL1
Qihoo-360Win32/Trojan.Doboc.HxQB6LwA
McAfeeTrojan-FGBQ!1EADEF36E463
CylanceUnsafe
ZillyaVirus.PolyRansom.Win32.3
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0040fa661 )
BitDefenderWin32.Doboc.Gen.1
K7GWTrojan ( 0040fa661 )
Cybereasonmalicious.6e4631
BitDefenderThetaAI:FileInfector.1210116D11
CyrenW32/S-d532404c!Eldorado
SymantecW32.Tempedreve.E!inf
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Trojan.Doboc-291
KasperskyVirus.Win32.PolyRansom.c
AlibabaRansom:Win32/polyransom.ali1020001
NANO-AntivirusTrojan.Win32.PolyRansom.dpzfcr
ViRobotWin32.Ursnif.A
Ad-AwareWin32.Doboc.Gen.1
TACHYONTrojan/W32.Doboc
EmsisoftWin32.Doboc.Gen.1 (B)
ComodoTrojWare.Win32.Ursnif.KIL@5jjifs
F-SecureTrojan.TR/Crypt.XPACK.Gen
BaiduWin32.Trojan.Kryptik.iq
VIPREVirus.Win32.Ursnif.ha (v)
TrendMicroPE_URSNIF.E
McAfee-GW-EditionBehavesLike.Win32.DocumentCrypt.fh
SophosMal/Generic-R + W32/MPhage-B
SentinelOneStatic AI – Malicious PE
WebrootW32.Ursnif
AviraTR/Crypt.XPACK.Gen
Antiy-AVLVirus/Win32.PolyRansom.c
KingsoftWin32.Infected.AutoInfector.a.(kcloud)
MicrosoftTrojan:Win32/Ursnif.KSV!MTB
ArcabitWin32.Doboc.Gen.1
SUPERAntiSpywareRansom.Cryptor/Variant
ZoneAlarmVirus.Win32.PolyRansom.c
GDataWin32.Doboc.Gen.1
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Ursnif.R158712
Acronissuspicious
VBA32SScope.Trojan.FakeAV.01681
MAXmalware (ai score=100)
MalwarebytesPolyRansom.Virus.FileInfector.DDS
PandaW32/CryptD.C
ESET-NOD32a variant of Win32/Kryptik.DCNW
TrendMicro-HouseCallPE_URSNIF.E
RisingTrojan.Kryptik!1.CC66 (CLOUD)
YandexTrojan.GenAsa!RK3x+npEgzs
IkarusTrojan-Ransom.Locky
eGambitUnsafe.AI_Score_99%
FortinetW32/Kryptik.DCNW!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
MaxSecureVirus.w32.PolyRansom.C

How to remove Win32.Doboc.Gen.1 (B)?

Win32.Doboc.Gen.1 (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment