Backdoor.Androm.A5 information

The Backdoor.Androm.A5 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Androm.A5 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Faeroese
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• A process attempted to delay the analysis task by a long amount of time.
• Created a process from a suspicious location

How to determine Backdoor.Androm.A5?

File Info:
name: 4FB472F67AA9B1993D09.mlw
path: /opt/CAPEv2/storage/binaries/04b4edb27b4da8dab635b7f863e39db57cebbfe86f1260af0ce1130ace0440f6
crc32: 93E3FCC7
md5: 4fb472f67aa9b1993d09d3afa6ef3d92
sha1: b983d87c2d267c8c05e3d6c6954f92dcb22277d1
sha256: 04b4edb27b4da8dab635b7f863e39db57cebbfe86f1260af0ce1130ace0440f6
sha512: a2c8e0b412a874a7ab68a2d39993a8c05cba771f41b43e352dde75b984e9b72507a0c9ffbf379892e63658c67856da478975b1cb02a6ada79809a56994f11bd7
ssdeep: 3072:2sajN75w92FcdtwDwArKDp8kzhZ+zWK1SwK4wRCiT+mwaQlnwHFERxCuVkahlUBx:2sajNEZp8KZAQpNdT+Vln6ExjGIUb
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E7644B4A3DE3C271E1AC6FF92884846F13369C12A8A68FB74EBD1178394FC43916576D
sha3_384: 4280b9f35a7d6e6c14d26f88602115f525c5ebfc473ae6c86cdcb646007a1d684389492a6bc7197dc247a5d00091a7b8
ep_bytes: e8a4190000e9b2150000cccccccccccc
timestamp: 2017-03-18 12:38:34

Version Info:
0: [No Data]

Backdoor.Androm.A5 also known as:

How to remove Backdoor.Androm.A5?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.