Backdoor.Generic.566006 (file analysis)

The Backdoor.Generic.566006 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Generic.566006 virus can do?

• Sample contains Overlay data
• HTTPS urls from behavior.
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Attempts to modify proxy settings
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor.Generic.566006?

File Info:
name: ADA34A5445687ABDFD50.mlw
path: /opt/CAPEv2/storage/binaries/ba27fc4d3a39816603856cd8f5584a2121bea8e8e1ae3ad472668c9e44906f60
crc32: C5DE1676
md5: ada34a5445687abdfd50198fa6087b4f
sha1: 449ba6ffc501a2fabdf8bcbd53a3ddd62acaef19
sha256: ba27fc4d3a39816603856cd8f5584a2121bea8e8e1ae3ad472668c9e44906f60
sha512: 663acc9f8579fd2facfe71c3f2b4cc102c88a0636915d1a111690a90afe4f6824b5415107df6ed565bca285a683bb6fb50cbc0428a689f1770e9555185f60973
ssdeep: 6144:AZC4d3lbxc6wU/UP+XhdMRFD3LAwekb8+SroSE:B4dMRU/UP4heFjLDF4+SroSE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16B24022BF61C940CE9AC5032864B18B46824FD1AC86849F532D1FF3F6E32F99E94975D
sha3_384: 07cd2764e72236f08144be61820b2939d6c1a91deae8a960cddd329e54a2b8e398fe27c32f2a0703fbdd46d62f6ea542
ep_bytes: 60be003044008dbe00e0fbff5789e58d
timestamp: 2009-09-25 18:57:32

Version Info:
FileDescription: 
FileVersion: 1, 0, 48, 05
InternalName: 
LegalCopyright: 
OriginalFilename: 
ProductName: 
ProductVersion: 1, 0, 48, 05
Translation: 0x0409 0x04b0

Backdoor.Generic.566006 also known as:

How to remove Backdoor.Generic.566006?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.