Categories: Backdoor

About “Backdoor.Bot.34899” infection

The Backdoor.Bot.34899 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Bot.34899 virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Executable file is packed/obfuscated with NsPack
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Creates a copy of itself
Deletes executed files from disk

How to determine Backdoor.Bot.34899?


File Info:
name: 88053A5581528D60F77B.mlwpath: /opt/CAPEv2/storage/binaries/e724c9ca67f246b22ad2348f38790e1bedac2d7c065e24df15392186ce7dd520crc32: 35CAA856md5: 88053a5581528d60f77bfeac2f35b4b8sha1: 4741245bfc304b6c5f8ec517ec2a6b2d42dc7f0dsha256: e724c9ca67f246b22ad2348f38790e1bedac2d7c065e24df15392186ce7dd520sha512: 43d7ddf6b7190d6a5a0501310aec3fe75ea032d3325c0509358e5ebdeb14c1b8272cfff7d22a7ef6d2ca18a81a375dd594931e6001b04758ab54208d17591962ssdeep: 1536:W2l+f/PKmFBf2Ef1baG2hzWyKZm2nuNX/2LQ1pWE1VwyPRuBGtWhMy8U/r0QvX2:Wx/SmFtf1GG8WPZhcX/5NROGtWOhInOtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T12593126072C82312FBFFB47685C8490B7BB6E555ED45EFD30A813562354CAC2AEA1363sha3_384: 3008ef3df25a53684bcd09b04780ce5616a235e52a04803b05d869688698896eacc01098fa55b9707101a57153242697ep_bytes: 9c60e8000000005d83ed078d8529fffftimestamp: 2006-01-12 01:22:48
Version Info:
0: [No Data]

Backdoor.Bot.34899 also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Agent.l7ah
Elastic	malicious (high confidence)
MicroWorld-eScan	Backdoor.Bot.34899
FireEye	Generic.mg.88053a5581528d60
ALYac	Backdoor.Bot.34899
Cylance	Unsafe
VIPRE	Backdoor.Bot.34899
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005257651 )
BitDefender	Backdoor.Bot.34899
K7GW	Trojan ( 005257651 )
Cybereason	malicious.581528
Arcabit	Backdoor.Bot.D8853
VirIT	Win32.Kriz.4029
Cyren	W32/Backdoor.ZIES-5295
Symantec	W32.IRCBot
ESET-NOD32	Win32/Rbot
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Mybot-2431
Kaspersky	Backdoor.Win32.Rbot.ank
Alibaba	Backdoor:Win32/Wmfap.13b2f388
NANO-Antivirus	Trojan.Win32.PePatch.wiwog
ViRobot	Backdoor.Win32.IRCBot.96768.G
Rising	Backdoor.Rbot.xtu (CLASSIC)
Ad-Aware	Backdoor.Bot.34899
Sophos	Mal/Generic-R + W32/Rbot-BKL
Comodo	Backdoor.Win32.Rbot@1ny2
DrWeb	Trojan.DownLoad.38304
Zillya	Backdoor.RBot.Win32.4765
TrendMicro	WORM_RBOT.DOM
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.nc
Trapmine	malicious.high.ml.score
Emsisoft	Backdoor.Bot.34899 (B)
Ikarus	Trojan.Win32.Genome
Jiangmin	TrojanSpy.Banker.oov
Webroot	W32.Rbot.Gen
Avira	TR/Crypt.PEPM.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASSuf.E522
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Backdoor:Win32/Rbot
ZoneAlarm	HEUR:Worm.Win32.Generic
GData	Backdoor.Bot.34899
Google	Detected
AhnLab-V3	Worm/Win32.IRCBot.C6996
McAfee	W32/Sdbot.ap.gen.ac
TACHYON	Backdoor/W32.RBot.96768.O
VBA32	OScope.Backdoor.Sdbot.Cgen
Malwarebytes	Malware.Heuristic.1003
Panda	Generic Malware
Zoner	Probably Heur.ExeHeaderP
TrendMicro-HouseCall	WORM_RBOT.DOM
Tencent	Backdoor.Win32.Sdbot.yx
Yandex	Worm.Akbot.Gen
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.67862.susgen
Fortinet	W32/IRCBot.DU!tr
BitDefenderTheta	AI:Packer.E6FD5B4A21
AVG	Win32:Rbot-CUA [Trj]
Avast	Win32:Rbot-CUA [Trj]
CrowdStrike	win/malicious_confidence_100% (W)