Categories: Backdoor

Backdoor.26 removal guide

The Backdoor.26 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.26 virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with ASPack
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Created a service that was not started

How to determine Backdoor.26?


File Info:
name: AA9C4A1EEC8202FB1D73.mlwpath: /opt/CAPEv2/storage/binaries/f58ef78238ffe027907160c115ead8a88648b283cd0a55ed3f2b3918242fef70crc32: 2437BD0Amd5: aa9c4a1eec8202fb1d735e41b7ee4394sha1: 0b6644b07c521741a6a273efd52551fe50fb9276sha256: f58ef78238ffe027907160c115ead8a88648b283cd0a55ed3f2b3918242fef70sha512: d723b4eb68841484cc198748ec591f53b29f5d40ee47655a5731d0eee09b890ab601163aa8ec4be205078562c96225a8262b61236329b41d34a3cc41fe98c2a0ssdeep: 1536:2Tk2KMqc7buEU/pls8hNRb4pz61Qj96wkr9EPHxdynWhNcW7WU:bo7buEU/zTN1I6lh8TN3type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1938302D90B0F9CEAD6D13D3372BF0850E2AB6D583E98014793B5E7BD691E05ED4B8608sha3_384: 2d01782a006c3e60e869b69777f0fa333f74fd90d3d38ffaa8f7899b011b7094a7be5be15a23029f57b16f0c375a51d2ep_bytes: 60e803000000e9eb045d4555c3e80100timestamp: 2011-01-03 11:39:54
Version Info:
0: [No Data]

Backdoor.26 also known as:

tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Backdoor.26
FireEye	Generic.mg.aa9c4a1eec8202fb
CAT-QuickHeal	Exploit.ShellCode.Gen
ALYac	Gen:Variant.Backdoor.26
Cylance	Unsafe
VIPRE	Gen:Variant.Backdoor.26
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Backdoor ( 00563cbc1 )
K7GW	Backdoor ( 00563cbc1 )
Cybereason	malicious.eec820
Cyren	W32/S-73c94f7f!Eldorado
Symantec	W32.Wapomi.C!inf
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Wapomi.X
APEX	Malicious
ClamAV	Win.Trojan.Wapomi-9939693-0
Kaspersky	Backdoor.Win32.Agent.bfax
BitDefender	Gen:Variant.Backdoor.26
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	FileRepMalware [Wrm]
Tencent	Trojan.Win32.KillAV.aaf
Ad-Aware	Gen:Variant.Backdoor.26
Emsisoft	Gen:Variant.Backdoor.26 (B)
Comodo	TrojWare.Win32.Agent.kajoh@2no451
DrWeb	BackDoor.Siggen.40151
Zillya	Backdoor.Agent.Win32.27075
TrendMicro	PE_WAPOMI.SM-O
McAfee-GW-Edition	BehavesLike.Win32.Ransomware.mc
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A + Mal/Behav-016
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor/Agent.cpie
Webroot	W32.Malware.Gen
Google	Detected
Avira	EXP/ShellCode.psa
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Generic.ASMalwS.61
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Backdoor.26
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Agent.R2670
McAfee	GenericRXAA-FA!AA9C4A1EEC82
VBA32	BScope.Backdoor.Bdaejec
Malwarebytes	Malware.AI.3277869085
TrendMicro-HouseCall	PE_WAPOMI.SM-O
Rising	Virus.Wapomi!8.55 (CLOUD)
Yandex	Trojan.GenAsa!wEiUiOeoewc
Ikarus	Exploit.Win32.ShellCode
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.JH!tr
BitDefenderTheta	Gen:NN.ZexaF.34682.fKWba0jnfBhb
AVG	FileRepMalware [Wrm]
Panda	Trj/Agent.OJS
CrowdStrike	win/malicious_confidence_100% (W)