Backdoor

Backdoor.Rbot removal

Malware Removal

The Backdoor.Rbot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.Rbot virus can do?

  • Attempts to connect to a dead IP:Port (3 unique times)
  • A process attempted to delay the analysis task.
  • Reads data out of its own binary image
  • Performs some HTTP requests
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
appfuscator.com
apps.identrust.com

How to determine Backdoor.Rbot?


File Info:

crc32: 29C6E234
md5: eb274a5605043ae768ac071e0ac3ddd1
name: EB274A5605043AE768AC071E0AC3DDD1.mlw
sha1: 10040eaaed55d39922eca75f46e95a46c466e652
sha256: 1dcd19d7eefb244122ae32de83f12cc54591082986b3c22688f8cc3828fe44c2
sha512: 82542a935ccf331d7c4402fad5d48b97dadd0e522bc0c3983d4342942871fe90a173f7974c7ca34fcdbd107ef7b4e4dea7b1cce17f84436f6f05129bb25f27d4
ssdeep: 12288:qRBk7ipC7tYR4eYLEkiw4PKEgOHS1ZBvKEjGbCAlLHgaSM:qjQeYLbKKEPS1bvKE2JAaSM
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

FileVersion: 1, 0, 0, 0
FileDescription:
Translation: 0x0809 0x04b0

Backdoor.Rbot also known as:

K7AntiVirusTrojan ( 004c78f61 )
LionicTrojan.Win32.Generic.a!c
ZillyaTrojan.Generic.Win32.1415899
CrowdStrikewin/malicious_confidence_70% (D)
K7GWTrojan ( 004c78f61 )
Cybereasonmalicious.aed55d
APEXMalicious
AvastWin32:PUP-gen [PUP]
CynetMalicious (score: 100)
KasperskyHEUR:Trojan-Downloader.Win32.Generic
NANO-AntivirusTrojan.Win32.Mlw.fbrupg
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Generic.bh
SentinelOneStatic AI – Suspicious PE
JiangminTrojanDownloader.Generic.badf
AviraTR/Dldr.Agent.qosle
MicrosoftTrojan:Win32/Wacatac.B!ml
McAfeeArtemis!EB274A560504
MAXmalware (ai score=97)
VBA32Backdoor.Rbot
RisingTrojan.Generic@ML.97 (RDMK:uFrvKvF4N3EDZ8flss89iw)
IkarusTrojan.ScreenLocker
FortinetRiskware/Application
AVGWin32:PUP-gen [PUP]
Paloaltogeneric.ml

How to remove Backdoor.Rbot?

Backdoor.Rbot removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment