Win32/Rostpay.F potentially unwanted malicious file

The Win32/Rostpay.F potentially unwanted is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Rostpay.F potentially unwanted virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Drops a binary and executes it
Performs some HTTP requests
Unconventionial language used in binary resources: Russian

Related domains:

api.az-partners.net

apps.identrust.com

isrg.trustid.ocsp.identrust.com

www.drvhub.net

How to determine Win32/Rostpay.F potentially unwanted?


File Info:
crc32: E595F910
md5: d8b8300661134f6e5aa33d8f982e16bc
name: driver-hub-install.exe
sha1: 515af25b49577dde10a3a1b9b102b63f83441b53
sha256: 09e50adcb811e152081b4233f2a3f34712d8cae59477d73c090d759359b9ec72
sha512: 7dad8add4872ae5abf10b3e2c12622122f264d2d5711b3607fefc9f903355dbdf68e200f2a0ec83e4bfbae332fcf25f9695a369fc8440157c2f8a96e8d3c94ea
ssdeep: 49152:32wBHuj2tNlt+W1C+Ani0JoFrhchcKFjq2y/k4aqdk7T9Ozjd+X2DZX+pKPNdA1A:3nBHuj2/ltbCFi0JohchBq2y/JdkfkzL
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 2019 ROSTPAY LTD. All rights reserved.
InternalName: DriverHub
FileVersion: 1.8.0.0
ProductName: DriverHub
ProductVersion: 1.8.0.0
FileDescription: DriverHub Installer
Translation: 0x0409 0x04b0

Win32/Rostpay.F potentially unwanted also known as:

DrWeb	Program.Unwanted.4320
MicroWorld-eScan	Trojan.GenericKD.33018735
FireEye	Trojan.GenericKD.33018735
CAT-QuickHeal	Trojan.Rostpay
Qihoo-360	Generic/Trojan.Generic.d67
McAfee	Artemis!D8B830066113
Cylance	Unsafe
K7AntiVirus	Adware ( 0055daa71 )
BitDefender	Trojan.GenericKD.33018735
K7GW	Adware ( 0055daa71 )
Endgame	malicious (high confidence)
Sophos	Generic PUA FB (PUA)
Comodo	Malware@#2l5mrnop6u1ji
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
McAfee-GW-Edition	Artemis
Emsisoft	Trojan.GenericKD.33018735 (B)
Cyren	W32/Application.OXLX-7896
Webroot	W32.Adware.Gen
Fortinet	Riskware/Generic_PUA_FB
Arcabit	Trojan.Generic.D1F7D36F
Microsoft	PUA:Win32/Rostpay
VBA32	SigRiskware.ROSTPAYLTD
ALYac	Trojan.GenericKD.33018735
MAX	malware (ai score=87)
Ad-Aware	Trojan.GenericKD.33018735
ESET-NOD32	a variant of Win32/Rostpay.F potentially unwanted
GData	Trojan.GenericKD.33018735
MaxSecure	Trojan.Malware.74813964.susgen

How to remove Win32/Rostpay.F potentially unwanted?

Win32/Rostpay.F potentially unwanted removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Rostpay.F potentially unwanted malicious file