Categories: Malware

Win32/KillMBR.NGJ information

The Win32/KillMBR.NGJ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/KillMBR.NGJ virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Creates RWX memory
Dynamic (imported) function loading detected
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Likely installs a bootkit via raw harddisk modifications
Attempted to write directly to a physical drive

How to determine Win32/KillMBR.NGJ?


File Info:
name: B1247C32137114A4DBF9.mlwpath: /opt/CAPEv2/storage/binaries/82830b1826e4c4791cca6520db9fa286b88da0f83b602079bc817ac0509309ebcrc32: 8F6A34DBmd5: b1247c32137114a4dbf9e16d87c9b883sha1: 3555ad20c7a2e151434ead0ecf7b70acbf22ecd8sha256: 82830b1826e4c4791cca6520db9fa286b88da0f83b602079bc817ac0509309ebsha512: 83b5b0d9243db6afc8f356dadcfb20f1341aa9cc6cc0e0b2ef399fcb7b7fa3831a96f18486a1071f8713606d6ed8999cef0054ecd3c4027fcf86a19aaf13ccb2ssdeep: 3072:SRki2rlaueBnX1etqQDK6xTTRMKPATM0Qeotx4mHZ7pout:SRki2ranXWq6xTTR1vtqmnoStype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B2C3129F616A3B22E28FCC3F12ABAD157930FE1594F69011D0EC2179E528D98232B775sha3_384: 89a91661e100ac40ce22b864a9d0213f02aec4823294b74d90379555c9e912326db0193559c41fbf21268dd4e03bde41ep_bytes: 60be00f044008dbe0020fbff5789e58dtimestamp: 2021-12-28 01:18:03
Version Info:
0: [No Data]

Win32/KillMBR.NGJ also known as:

Lionic	Trojan.Win32.DiskWriter.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
McAfee	RDN/Generic PUP.z
Cylance	Unsafe
Zillya	Trojan.DiskWriter.Win32.1888
Sangfor	Adware.Win32.Agent.gen
K7AntiVirus	Trojan ( 0051918e1 )
BitDefender	Gen:Variant.Adware.Symmi.67308
K7GW	Trojan ( 0051918e1 )
CrowdStrike	win/malicious_confidence_60% (D)
ESET-NOD32	a variant of Win32/KillMBR.NGJ
APEX	Malicious
Kaspersky	Trojan.Win32.DiskWriter.hhk
Alibaba	Ransom:Win32/DiskWriter.244d627d
ViRobot	Adware.Symmi.125952.A
MicroWorld-eScan	Gen:Variant.Adware.Symmi.67308
Avast	Win32:Adware-gen [Adw]
Tencent	Win32.Trojan.Trojan.Hnjw
Ad-Aware	Gen:Variant.Adware.Symmi.67308
Sophos	BlackMoon Packed (PUA)
F-Secure	Trojan.TR/ATRAPS.Gen
TrendMicro	TROJ_GEN.R03FC0PA922
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
FireEye	Generic.mg.b1247c32137114a4
Emsisoft	Gen:Variant.Adware.Symmi.67308 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Adware.Symmi.67308
Jiangmin	Trojan.DiskWriter.aob
eGambit	Unsafe.AI_Score_87%
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan/Generic.ASCommon.218
Kingsoft	Win32.Troj.DiskWriter.h.(kcloud)
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Adware.Symmi.D106EC
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	Adware/Win.Symmi.C4899671
BitDefenderTheta	Gen:NN.ZexaF.34160.hqGfaCGiu4di
ALYac	Gen:Variant.Adware.Symmi.67308
MAX	malware (ai score=86)
VBA32	Trojan.DiskWriter
TrendMicro-HouseCall	TROJ_GEN.R03FC0PA922
Rising	Trojan.Kryptik!1.AAD1 (CLOUD)
Yandex	Trojan.GenAsa!uR6xGWgqKU8
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CoinMiner.ESFJ!tr
AVG	Win32:Adware-gen [Adw]
Cybereason	malicious.213711
Panda	Trj/GdSda.A