Backdoor.Vb.NG (file analysis)

The Backdoor.Vb.NG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.Vb.NG virus can do?

Behavioural detection: Executable code extraction – unpacking
At least one process apparently crashed during execution
Dynamic (imported) function loading detected
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Backdoor.Vb.NG?


File Info:
name: 104C4C46383FA8A8D1C0.mlw
path: /opt/CAPEv2/storage/binaries/e0538e0baf080002ffe53094eed58c1149930021fdf28850a74381d50de5b39e
crc32: 97887B69
md5: 104c4c46383fa8a8d1c09a1f81b31c8b
sha1: 3ac93c96f8bd70cc16b1d8043888208b924843d6
sha256: e0538e0baf080002ffe53094eed58c1149930021fdf28850a74381d50de5b39e
sha512: f9cbd36d80ee98001af949f4a07faa825998ab3946759bad9dfcc775cf4b43fdeb88d25b44610c1734fb55455d02e7e0288440bffd165950ff051d01c22c9479
ssdeep: 3072:dG2gbgLpH840cuJrn2cfJpVXtsAvoBZoQX1pPUdAbOS+O5kwyGNg:d0I1840fJ7VfJLXmZoQX1pPBl5W
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T199445D2AB360A73FF25186B2696942B5C5AD7C340968B403F3817F1E3BE6ED79521313
sha3_384: d3b02b7ee64f80e48843371f1b7768188d80e873f4ffc27f2b244aac455854344004891cbce82db5297a1feb59b58d31
ep_bytes: 68d8844000e8f0ffffff000000000000
timestamp: 2007-01-26 10:10:09

Version Info:
Translation: 0x040c 0x04b0
ProductName: Update MGA
FileVersion: 1.00.0002
ProductVersion: 1.00.0002
InternalName: mga
OriginalFilename: mga.exe

Backdoor.Vb.NG also known as:

DrWeb	BackDoor.Update.50
MicroWorld-eScan	Backdoor.Vb.NG
FireEye	Generic.mg.104c4c46383fa8a8
ALYac	Backdoor.Vb.NG
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.6383fa
BitDefenderTheta	Gen:NN.ZevbaF.34182.qm0@a4MFXlge
VirIT	Backdoor.Win32.Generic.HSM
Cyren	W32/SillyBackdoor.A.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Ullysee.C
TrendMicro-HouseCall	BKDR_VB.CPW
Kaspersky	Backdoor.Win32.VB.gee
BitDefender	Backdoor.Vb.NG
NANO-Antivirus	Trojan.Win32.VB.jnha
Avast	FileRepMalware
Emsisoft	Backdoor.Vb.NG (B)
TrendMicro	BKDR_VB.CPW
McAfee-GW-Edition	BehavesLike.Win32.VBObfus.dm
Sophos	Mal/Generic-S
Ikarus	Email-Worm.Win32.Hermes
Jiangmin	Backdoor/VB.ntk
MaxSecure	Trojan.Malware.300983.susgen
Avira	BDS/Backdoor.Gen
MAX	malware (ai score=89)
Microsoft	Backdoor:Win32/Agent
ZoneAlarm	Backdoor.Win32.VB.gee
GData	Backdoor.Vb.NG
Cynet	Malicious (score: 99)
McAfee	VB-BackDoor.a.gen
VBA32	BScope.Trojan.MulDrop
APEX	Malicious
Rising	Backdoor.Win32.Agent.a (CLASSIC)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_65%
Fortinet	W32/Ullysee.C!tr
AVG	FileRepMalware
Panda	Bck/Vb.WP
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Backdoor.Vb.NG?

Backdoor.Vb.NG removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X