About “Backdoor.MSIL.NanoBot.aqsh” infection

The Backdoor.MSIL.NanoBot.aqsh is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.MSIL.NanoBot.aqsh virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• CAPE detected the NanoCore malware family
• Creates a copy of itself
• Creates known CypherIT/Frenchy Shellcode mutexes
• Collects information to fingerprint the system
• Anomalous binary characteristics

How to determine Backdoor.MSIL.NanoBot.aqsh?

File Info:
name: AFDCD1FBBCC896D421A2.mlw
path: /opt/CAPEv2/storage/binaries/c7bcd6bfb8874c0805b77dd4a6be020465280acfc2ae46b11cb226c72c50b89e
crc32: 71374211
md5: afdcd1fbbcc896d421a29157fa8dbb4d
sha1: 2e09c684e98e878a61b06fa35fc8a42046a66a2b
sha256: c7bcd6bfb8874c0805b77dd4a6be020465280acfc2ae46b11cb226c72c50b89e
sha512: aa4a9f326f24909476c3e2856e4918437a1ec1bd4e9605723a57a35a48d1370ee55fa33e942d0c846c725d252f9649b4899bd331c661648fd32688c180612fb9
ssdeep: 24576:GAHnh+eWsN3skA4RV1Hom2KXFmIawVBAB6p5losW2uFfJpQc5:hh+ZkldoPK1XaWG2C2Kht
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11055BE027792C036FEE6A2739F65F2465A7DBC690133C12F52983D78BD702B1276D262
sha3_384: 033cea76438b37d72e20d7deb84849812bbd6bcb5ba692d6812e07f8632752d43bea5bb4174ea164f06bd234feacc8d9
ep_bytes: e8c8d00000e97ffeffffcccccccccccc
timestamp: 2019-06-07 17:15:15

Version Info:
FileDescription: AppvClientEventLog
OriginalFilename: RtDCpl64
CompanyName: tscon
FileVersion: 777.557.698.676
LegalCopyright: PackagedCWALauncher
ProductName: appmgmts
ProductVersion: 125.348.318.512
Translation: 0x0409 0x04b0

Backdoor.MSIL.NanoBot.aqsh also known as:

How to remove Backdoor.MSIL.NanoBot.aqsh?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.