Categories: Backdoor

What is “Backdoor.Turkojan”?

The Backdoor.Turkojan is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Turkojan virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process created a hidden window
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Deletes its original binary from disk
Sniffs keystrokes
Installs itself for autorun at Windows startup
Creates a copy of itself
Attempts to disable UAC
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Turkojan?


File Info:
crc32: 7AD79526md5: 53aa23b5ca5a46a7af7d15404fb80170name: turko.exesha1: 17a68bd6c1a548ca2bb12de8e648d6ce0e2c1a7asha256: ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237sha512: 07b4b1d43a3a308dad20d7dbaa27996cb2b11edede70cee6d3283315075935c1074547e048d2de38d6a074aa7857c2ade0e1505251512d955dbcb7407b2c58e0ssdeep: 3072:Yoy8j7VnNdrPHaSekwi+mW+2jLcJkz0dout:o8jZ7rvaU3+mWrjLM3doStype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
0: [No Data]

Backdoor.Turkojan also known as:

Bkav	W32.MstwainCmseLnr.Trojan
MicroWorld-eScan	Backdoor.Turkojan.AF
CMC	Trojan-Dropper.Win32.Typic!O
CAT-QuickHeal	Backdoor.Turkojan.A8
Qihoo-360	Backdoor.Win32.Turkojan.B
McAfee	BackDoor-CZP.dr
Cylance	Unsafe
VIPRE	Backdoor.Win32.Turkojan.il (v)
SUPERAntiSpyware	Trojan.Agent/Gen-Frauder[Twain]
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Backdoor.Turkojan.AF
K7GW	Trojan ( 0002ec661 )
K7AntiVirus	Trojan ( 0002ec661 )
Arcabit	Backdoor.Turkojan.AF
Invincea	heuristic
Baidu	Win32.Backdoor.Cakl.c
F-Prot	W32/Turkojan.C.gen!Eldorado
Symantec	Backdoor.Trojan
ESET-NOD32	Win32/Cakl.NAG
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Truko-10
Kaspersky	Backdoor.Win32.Turkojan.zwh
Alibaba	Backdoor:Win32/Turkojan.448227e4
NANO-Antivirus	Trojan.Win32.Turkojan.jebp
Rising	Backdoor.Turkojan!1.66E8 (CLOUD)
Ad-Aware	Backdoor.Turkojan.AF
Emsisoft	Backdoor.Turkojan.AF (B)
Comodo	Backdoor.Win32.turkojan.ek6@1kjvh2
F-Secure	Backdoor:W32/Turkojan.gen!A
DrWeb	Win32.HLLW.MyBot
Zillya	Backdoor.Turkojan.Win32.26829
TrendMicro	BKDR_TURKOJN.SMD
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.cc
Fortinet	W32/Agent.GMF!tr.bdr
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.53aa23b5ca5a46a7
Sophos	Troj/Agent-GMF
Ikarus	Trojan.Win32.Cakl
Cyren	W32/Turkojan.C.gen!Eldorado
Jiangmin	Backdoor/Turkojan.x
Webroot	W32.Trojan.Gen
Avira	BDS/Turkojan.im
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Win32.Turkojan.gic
Endgame	malicious (moderate confidence)
Microsoft	Backdoor:Win32/Turkojan.AI
ViRobot	Backdoor.Win32.Turkojan.110592.W
ZoneAlarm	Backdoor.Win32.Turkojan.zwh
AhnLab-V3	Trojan/Win32.Turkojan.R1451
Acronis	suspicious
VBA32	Trojan.SDP.27105
ALYac	Backdoor.Turkojan
TACHYON	Trojan/W32.DP-Agent.276992.F
Panda	Bck/Turkojan.X
Zoner	Trojan.Win32.32514
TrendMicro-HouseCall	BKDR_TURKOJN.SMD
Tencent	Malware.Win32.Gencirc.10b0cccb
Yandex	Backdoor.Turkojan.I
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_100%
GData	Backdoor.Turkojan.AF
BitDefenderTheta	AI:Packer.B0A5041719
AVG	Win32:Morphine-CD [Trj]
Cybereason	malicious.5ca5a4
Avast	Win32:Morphine-CD [Trj]
MaxSecure	Trojan.BackDoor-CZP.Dr