Backdoor.Win32.Androm.qgai removal

The Backdoor.Win32.Androm.qgai is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Androm.qgai virus can do?

Executable code extraction
Creates RWX memory
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
Spoofs its process name and/or associated pathname to appear as a legitimate process
Creates a hidden or system file
Creates a copy of itself
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

kaokao-twn.com

How to determine Backdoor.Win32.Androm.qgai?


File Info:
crc32: 698BE436
md5: 7975a7d1819d2ccd9b381ae5fbe17851
name: 7975A7D1819D2CCD9B381AE5FBE17851.mlw
sha1: a5c33134f560b0780790c39e8db1c0ea545d19e3
sha256: d18b705b3af415d4c000b9d5a18501eca6fe25327111e246336f3db4211907ac
sha512: f75ebd26bfc587311858cadc56204d697a0735f3c0f65f3ad037f2b7d964f9a4b7d17a33a486f7eedcb883f09d4f812fdffa4f25db819e4cddd7f1923b470861
ssdeep: 6144:GWbUffuD/tN7Kxm6NXwnI+3ObqYDQDAITD0gQ4jkGq:GWbouONXOwbtDUAITogxjkG
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
Assembly Version: 9.5.5.29
LegalCopyright: Copyright xa9Flipkart 1999 - 2014
InternalName: Dequeues Pwerpint
FileVersion: 9.5.5.29
CompanyName: Flipkart
FileDescription: Literate Carding Ashx Represented Bronze
LegalTrademarks: Copyright xa9Flipkart 1999 - 2014
Comments: Literate Carding Ashx Represented Bronze
ProductName: Dequeues Pwerpint
Languages: English
ProductVersion: 9.5.5.29
PrivateBuild: 9.5.5.29
OriginalFilename: Dequeues Pwerpint
Translation: 0x0409 0x04b0

Backdoor.Win32.Androm.qgai also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 00537eba1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.23680
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ransom.Scarab.43
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Alibaba	Backdoor:Win32/Androm.061a060c
K7GW	Trojan ( 00537eba1 )
Cybereason	malicious.1819d2
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.GIWU
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Backdoor.Win32.Androm.qgai
BitDefender	Gen:Variant.Ransom.Scarab.43
NANO-Antivirus	Trojan.Win32.Stealer.ffraxx
MicroWorld-eScan	Gen:Variant.Ransom.Scarab.43
Tencent	Malware.Win32.Gencirc.114d460f
Ad-Aware	Gen:Variant.Ransom.Scarab.43
Sophos	Mal/Generic-S
Comodo	Malware@#s6e15lzgjx6w
BitDefenderTheta	Gen:NN.ZexaF.34142.rmKfaysQCOoi
VIPRE	Packer.NSAnti.Gen (v)
McAfee-GW-Edition	GenericRXGH-XB!11F120F5CD92
FireEye	Generic.mg.7975a7d1819d2ccd
Emsisoft	Gen:Variant.Ransom.Scarab.43 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1120553
Antiy-AVL	Trojan/Generic.ASMalwS.27BE7CF
Microsoft	Trojan:Win32/Occamy.C
ZoneAlarm	Backdoor.Win32.Androm.qgai
GData	Gen:Variant.Ransom.Scarab.43
AhnLab-V3	Win-Trojan/Sagecrypt.Gen
McAfee	Artemis!7975A7D1819D
MAX	malware (ai score=100)
VBA32	Backdoor.Androm
Malwarebytes	Spyware.LokiBot
Panda	Trj/CI.A
Yandex	Trojan.GenAsa!+g5+QohAjdg
Ikarus	Trojan-Ransom.GandCrab
Fortinet	W32/Kryptik.GKDU!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Backdoor.Win32.Androm.qgai?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.Win32.Androm.qgai removal