How to remove “Backdoor.InfoStealer”?

The Backdoor.InfoStealer is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.InfoStealer virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Anomalous .NET characteristics
• Sniffs keystrokes
• Deletes its original binary from disk
• Created a process from a suspicious location
• Steals private information from local Internet browsers
• Installs itself for autorun at Windows startup
• CAPE detected the SpyGate malware family
• Checks the CPU name from registry, possibly for anti-virtualization
• Creates a copy of itself
• Harvests credentials from local FTP client softwares
• Harvests information related to installed instant messenger clients
• Collects information to fingerprint the system

How to determine Backdoor.InfoStealer?

File Info:
name: 8996E7D92F3E74B3F9FE.mlw
path: /opt/CAPEv2/storage/binaries/bbcc41a76ae6fe055bf71223a9f87ede2450b9d2704fd3b7821c27450ae07d89
crc32: CB41DA8F
md5: 8996e7d92f3e74b3f9fe937dcc6a6442
sha1: 0ba551dd363317833f3edea5e1e14a617ca1fea3
sha256: bbcc41a76ae6fe055bf71223a9f87ede2450b9d2704fd3b7821c27450ae07d89
sha512: 4c3af523f649cab9567ec20af007cb850d4080de5995af247b72dbc7d961ec28742f49beb056f20df0591a5b02c2393c96c5efc8274c277afbaf38f2d7e64869
ssdeep: 1536:y/BmvftFstac0hBjkJRHXfo31bjmVeLRJwiXjO7HUEotQtGDew8Wef:y/2tfjmHXfoFGiXS7EQtGDD3e
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17FA34A493BD4AD21DAFE6FB90472050583B1D16F5A13EB8E1CC148E91BBBB844E436E7
sha3_384: 70317ff37162e4f6eb7e0d030e086ce9d882f43d375bb449cbaa6bc1bf2c889f1d056b3af5844e58f43c0c14f78fceea
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-01-15 21:56:23

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: Stub.exe
LegalCopyright:  
OriginalFilename: Stub.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Backdoor.InfoStealer also known as:

How to remove Backdoor.InfoStealer?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.