The file GH.EXE is identified as a virus dropper.
The dropper GH.EXE is used for downloading and installing other malware, Trojans, viruses by the commands received from the Command Center.
The file GH.EXE loads into the computer memory and tries to connect to the dangerous web site.
Usually the GH.EXE dropper does not infect the files on the computer and does not replicate itself on other computers.
Kill the GH.EXE process and delete the file GH.EXE.
Malware Analysis of GH.EXE
Full path on a computer: %Temp%\gh.exe
Detected by UnHackMe:
GH.EXE
Default location: %Temp%\gh.exe
Removal Results: Success
Number of reboot: 1
GH.EXE is known as:
Trojan.Bladabindi, Backdoor.MSIL.Bladabindi.A, Trojan.DownLoader10.63222, Backdoor.MSIL.Bladabindi.a (v), BKDR_BLADABI.SMC, Mal.Bbindi-B, Backdoor:MSIL.Bladabindi.AJ, Win-Trojan.Zbot.24064, Trojan.MSIL.Disfa, a variant of MSIL.Bladabindi.BH, Backdoor.MSIL, MSIL.Bladabindi.Q.tr, PSW.ILUSpy
GH.EXE hash:
- MD5: 031f74bd77c24d4d101907c3208e96ba
Registry:- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\fd016cff0b19d18f8646cc0a4b35b73e: “”%Temp%\gh.exe” ..”
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\fd016cff0b19d18f8646cc0a4b35b73e: “”%Temp%\gh.exe” ..”
Files:- %Temp%\gh.exe