Backdoor.MSIL.NanoBot.avkf malicious file

The Backdoor.MSIL.NanoBot.avkf is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.MSIL.NanoBot.avkf virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Creates known CypherIT/Frenchy Shellcode mutexes
• Anomalous binary characteristics

How to determine Backdoor.MSIL.NanoBot.avkf?

File Info:
name: BB679BEC1C244E90324D.mlw
path: /opt/CAPEv2/storage/binaries/d959d357dac740b5eed96bc85b4b0016a8bb5e2fdf76d60e370978314d463f6a
crc32: B286C2BC
md5: bb679bec1c244e90324df6451c6af63a
sha1: aae524cfc3c4dc2396ae4379d73fc4177692a4dd
sha256: d959d357dac740b5eed96bc85b4b0016a8bb5e2fdf76d60e370978314d463f6a
sha512: 82522e691c3274e978e60c04ea6b5f13e1c08d8f2915b842846625e0928b389079469d0b0e3680b3444e31dd663696d6a09ca5d07f6f066d8a6903b5a792c97b
ssdeep: 24576:9AHnh+eWsN3skA4RV1Hom2KXMmHawJoxD7xV4wGLXiFRmo5:ch+ZkldoPK8YawJoBEJLX2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15245BD0273D1C036FFABA2739B6AF64156BC79254123852F13981DB9BD701B2237E663
sha3_384: f865f47c2e352eadca5d0bea8e08d9ce2c0c44c2257cfaaa456b55ee78cd9b2e8fecbee997b93eb165f3118dfdf75935
ep_bytes: e8c8d00000e97ffeffffcccccccccccc
timestamp: 2019-09-16 00:10:39

Version Info:
FileDescription: BthAvrcp
OriginalFilename: fsavailux
CompanyName: RMActivate
FileVersion: 495.84.592.577
LegalCopyright: BootMenuUX
ProductName: takeown
ProductVersion: 445.378.961.689
Translation: 0x0409 0x04b0

Backdoor.MSIL.NanoBot.avkf also known as:

How to remove Backdoor.MSIL.NanoBot.avkf?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.