Should I remove “Backdoor.RAT.cobian”?

The Backdoor.RAT.cobian is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.RAT.cobian virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Backdoor.RAT.cobian?


File Info:
name: 49673536F58C909B47E6.mlw
path: /opt/CAPEv2/storage/binaries/12ba36c3b859fe93e3b796be6c210f444d51d062b0ecad7893b9feaf798838f6
crc32: 744CC2AF
md5: 49673536f58c909b47e60f1eca9ddf27
sha1: 1ddc08a198dc4a76658a192686d1dd2e0f790be0
sha256: 12ba36c3b859fe93e3b796be6c210f444d51d062b0ecad7893b9feaf798838f6
sha512: ebd0189a0c4e4cc9b6546086dc8e00803941e18c8aac139ae8709aacc3efc0a612db7c65fcd7bd64e5339769283ebee57c50cdc1679782d6eedf1a41daf67812
ssdeep: 6144:jjBxP0K7v3VV6aJBlwJU7CwT/9rEJvzojlX:jPP7zJTww3L9IJvzojl
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D254512C3B055E62FF1F997089010B28BBA6BF537280A9C397DB25CB875F1676D15C88
sha3_384: 2a0a480d62dab352be38ccece531811645e400ee5828c73903248ba111ebdf4c79259fd8a4ba282f968122c0e17a7f84
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-06-16 15:53:09

Version Info:
Comments: 
CompanyName: 
FileVersion: , , , 
FileDescription: 
LegalCopyright: 
ProductName: 
ProductVersion: , , , 
Translation: 0x0409 0x04b0

Backdoor.RAT.cobian also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Stealer.l!c
Elastic	malicious (high confidence)
McAfee	GenericRXRU-WN!49673536F58C
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005819cf1 )
Alibaba	Trojan:Win32/runner.ali1000123
K7GW	Trojan ( 005819cf1 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/MSIL_Kryptik.HMD.gen!Eldorado
ESET-NOD32	a variant of MSIL/Injector.VRI
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.pef
BitDefender	Trojan.GenericKD.49191428
MicroWorld-eScan	Trojan.GenericKD.49191428
Avast	Win32:InjectorX-gen [Trj]
Tencent	Win32.Trojan-spy.Stealer.Pdml
Ad-Aware	Trojan.GenericKD.49191428
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Injector.ftbwa
TrendMicro	TROJ_GEN.R002C0PFG22
McAfee-GW-Edition	GenericRXRU-WN!49673536F58C
FireEye	Generic.mg.49673536f58c909b
SentinelOne	Static AI – Malicious PE
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.pef
GData	MSIL.Backdoor.Bladabindi.T62WHD
AhnLab-V3	Trojan/Win.InjectorX-gen.C5173311
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.34742.sm0@aa4UvOhi
ALYac	Backdoor.RAT.cobian
MAX	malware (ai score=85)
Malwarebytes	Trojan.Crypt.MSIL
TrendMicro-HouseCall	TROJ_GEN.R002C0PFG22
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:NdnO8f1g8C3NpxqySDwLCQ)
Ikarus	Win32.Outbreak
Fortinet	MSIL/Injector.VRI!tr
AVG	Win32:InjectorX-gen [Trj]

How to remove Backdoor.RAT.cobian?

Backdoor.RAT.cobian removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X