Categories: Malware

Win32/Filecoder.NHQ removal tips

The Win32/Filecoder.NHQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Filecoder.NHQ virus can do?

Executable code extraction
Creates RWX memory
Detected script timer window indicative of sleep style evasion
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
A scripting utility was executed
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself
Collects information to fingerprint the system

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Filecoder.NHQ?


File Info:
crc32: C072E4E3md5: 48900fa8c118645a20a406bb3e342a53name: upload_filesha1: 3a0df5ce9bbe70d7dca5ff8d23227614318f891bsha256: 9ae1279cf4b1c169fbc7d9554fce35adc88487c20dadf1c4301829003a1d374bsha512: 27b5f1ca76a175f43a8b11bfc24824e34816e2836640e4dc8cafabb9f397d2b306b1e7591783e7f2da6f416b9d289cddc52938887c2591d6522c8acfbf35af78ssdeep: 12288:rHxHbps6eCvIpbRuxw61WgdDkvqwcVDYX4k:VTexpcxw6RaWYXPtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (c) 2014 - . All rights reserved. labDVxfffdInternalName: LagsFileVersion: 7.8.9.4CompanyName: labDVxfffdFileDescription: Macsx Appraisals Eggheads Landscape DropoutComments: Macsx Appraisals Eggheads Landscape DropoutProductName: LagsProductVersion: 7.8.9.4PrivateBuild: 7.8.9.4OriginalFilename: LagsTranslation: 0x0409 0x04b0

Win32/Filecoder.NHQ also known as:

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.GenericKD.43557459
FireEye	Generic.mg.48900fa8c118645a
McAfee	GenericRXBG-ZF!48900FA8C118
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.SageCrypt.j!c
K7AntiVirus	Trojan ( 004f76a01 )
BitDefender	Trojan.GenericKD.43557459
K7GW	Trojan ( 004f76a01 )
Cybereason	malicious.8c1186
TrendMicro	Mal_MiliCry-1h
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
GData	Trojan.GenericKD.43557459
Kaspersky	Trojan-Ransom.Win32.SageCrypt.dcv
Alibaba	Ransom:Win32/SageCrypt.1910aa8e
NANO-Antivirus	Trojan.Win32.SageCrypt.falyiz
Rising	Ransom.Milicry!8.A2F2 (CLOUD)
TACHYON	Ransom/W32.SageCrypt.475136
Emsisoft	Trojan.GenericKD.43557459 (B)
F-Secure	Trojan.TR/AD.Sage.icukk
DrWeb	Trojan.Encoder.10781
Zillya	Trojan.SageCrypt.Win32.177
Invincea	heuristic
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
SentinelOne	DFI – Malicious PE
Jiangmin	Trojan.SageCrypt.hj
Avira	TR/AD.Sage.icukk
Antiy-AVL	Trojan/Win32.TSGeneric
Arcabit	Trojan.Generic.D298A253
ZoneAlarm	Trojan-Ransom.Win32.SageCrypt.dcv
Microsoft	Ransom:Win32/Milicry!rfn
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Sagecrypt.Gen
VBA32	BScope.Trojan-Ransom.SageCrypt
ALYac	Trojan.GenericKD.43557459
MAX	malware (ai score=82)
Ad-Aware	Trojan.GenericKD.43557459
Panda	Trj/CI.A
ESET-NOD32	Win32/Filecoder.NHQ
TrendMicro-HouseCall	Mal_MiliCry-1h
Tencent	Malware.Win32.Gencirc.10b2ea82
Yandex	Trojan.SageCrypt!
Ikarus	Trojan-Ransom.FileCrypter
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Generic.AP.C8398!tr
BitDefenderTheta	Gen:NN.ZexaF.34138.Dq0@aCVy6lmi
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Trojan.Generic