Backdoor.PsixBot malicious file

The Backdoor.PsixBot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.PsixBot virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Attempts to connect to a dead IP:Port (1 unique times)
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities for basic functionality

Related domains:

How to determine Backdoor.PsixBot?

File Info:
name: B0CC001C26FD5FCF73D6.mlw
path: /opt/CAPEv2/storage/binaries/061734acfaf36dedc370ce047e3d351429ce57a6e7257ca465bd43d8541a14c7
crc32: 0692A7A1
md5: b0cc001c26fd5fcf73d6fefcc67d6e5c
sha1: 2554c4b0b86f009fc0aee82775342e70a4f51c54
sha256: 061734acfaf36dedc370ce047e3d351429ce57a6e7257ca465bd43d8541a14c7
sha512: b8d57759f5c0861d322d338ea91385458928bd010961c89da97983844f4e6061c4f5b464434ebd21ffc38d4d97d7b37d96ecb9a6648ee39192c0423111ef9f50
ssdeep: 3072:tZTz1WIXC6GESSgWNRXumi7+IF6foPCaTRMXbaev0FQcmWk6kwsNIf6cHzbQ2v0V:tZHcIX9SSgMi+IFZMbQrkodzb4VF2Yd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T111846B0177E08636D1BE4A35A8B1462586B9F4271A21CF9F3ECC16E94F717C09B21FA7
sha3_384: 45cea9ed9d4d6f6982ae754c76f6a43a1c34929a27c6385923676fae23455db48bb0002722da185e652371059910252f
ep_bytes: e81a050000e98efeffff558bec6a00ff
timestamp: 2018-02-27 19:15:05

Version Info:
CompanyName: Microsoft inc.
FileDescription: Windows Audio Driver
FileVersion: 4.3.12.157
InternalName: audiohd.exe
LegalCopyright: Copyright (C) 2016
OriginalFilename: audiohd.exe
ProductName: Windows Audio Driver
ProductVersion: 1.5.7.2
Translation: 0x0419 0x04b0

Backdoor.PsixBot also known as:

How to remove Backdoor.PsixBot?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.