Backdoor

Backdoor.MSIL.Orcus information

Malware Removal

The Backdoor.MSIL.Orcus is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor.MSIL.Orcus virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Backdoor.MSIL.Orcus?



File Info:

name: E6B8AA1D24ACA3E269F5.mlw
path: /opt/CAPEv2/storage/binaries/dc0b11c322962777800bbbf46a77413d8eef877f4805e46bd967b130c07cbdca
crc32: 1AE521F3
md5: e6b8aa1d24aca3e269f5fc141876095b
sha1: 3f14da3a117b3b6e5ec5947d4ac0a25d5cf80d06
sha256: dc0b11c322962777800bbbf46a77413d8eef877f4805e46bd967b130c07cbdca
sha512: c6cf3a220e0113868b78e12332023533f4c09f9417bfef89f2d2bb0dc079ca7ae349584065d5baa7d4f227a8ada73575f8fdbda6830db63cf05e0b17326872eb
ssdeep: 6144:eCYQ+YZdRgfJeowB1ZksUZh2XfAssqb92gE0Htv5zCzqdsIiK59cfXqe82Gg/MSM:3YwGsWQoS2gE0h5+zqdsvrU4PVmwOv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T196A4E03E7694CF02C56A54B6C5DF5A3803F9AC832773CB962E9532991E417B2DC42ACC
sha3_384: 30b812de7fb28ffd130a1dda8f2e8a855bf26a015c39391e311926183976e4dfee01a65ad7b16753d762d7cc516976cc
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-09-18 14:48:56


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: File System Watcher
FileDescription: File System Watcher
FileVersion: 1.0.0.0
InternalName: File System Watcher.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: File System Watcher
OriginalFilename: File System Watcher.exe
ProductName: File System Watcher
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Backdoor.MSIL.Orcus also known as:

BkavW32.AIDetectNet.01
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.62484430
FireEyeGeneric.mg.e6b8aa1d24aca3e2
McAfeeArtemis!E6B8AA1D24AC
CylanceUnsafe
VIPREGen:Variant.MSILHeracles.43125
SangforSuspicious.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaMalware:Win32/Dorpal.ali1000029
K7AntiVirusTrojan ( 005942821 )
ESET-NOD32a variant of MSIL/Agent.VLR
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Backdoor.MSIL.Orcus.gen
BitDefenderTrojan.GenericKD.62484430
AvastWin32:RATX-gen [Trj]
TencentMsil.Backdoor.Orcus.Hmnw
Ad-AwareTrojan.GenericKD.62484430
EmsisoftTrojan.GenericKD.62484430 (B)
DrWebTrojan.Siggen18.54255
McAfee-GW-EditionArtemis!Trojan
Trapminemalicious.moderate.ml.score
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
GDataTrojan.GenericKD.62484430
AviraHEUR/AGEN.1235849
ArcabitTrojan.MSILHeracles.DA875
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 99)
AhnLab-V3Trojan/Win.Generic.C5271440
Acronissuspicious
BitDefenderThetaGen:NN.ZemsilF.34698.Bq0@aq!tIFp
MAXmalware (ai score=80)
MalwarebytesMachineLearning/Anomalous.97%
TrendMicro-HouseCallTROJ_GEN.R002H0CJ322
RisingTrojan.Generic/MSIL@AI.100 (RDM.MSIL:jeLK489vHWGeIMcRR9g2Kw)
MaxSecureTrojan.Malware.300983.susgen
FortinetPossibleThreat
AVGWin32:RATX-gen [Trj]
Cybereasonmalicious.a117b3

How to remove Backdoor.MSIL.Orcus?

Backdoor.MSIL.Orcus removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment