Backdoor

Backdoor.Win32.Emotet.ajsw removal guide

Malware Removal

The Backdoor.Win32.Emotet.ajsw is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.Win32.Emotet.ajsw virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Mimics the system’s user agent string for its own requests
  • Expresses interest in specific running processes
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Russian

How to determine Backdoor.Win32.Emotet.ajsw?


File Info:

crc32: 53F3FF2A
md5: b99fd7b2c166efd42ec6a4bed96d53ec
name: upload_file
sha1: aace59f8f7416ec44bf491a3d448e93e65e7d62e
sha256: d99fb23c5761e184ca2bd6c043aa68a05ecbdc45635e360ffd5330dd008d6309
sha512: 64234b4064d6f031bbadd0c2fabc83b4b607f63ea77b8daf39077195294879e72aac99de9effffe5be995d3b012c0b8fb632db4986f379821bea218f5f441baa
ssdeep: 6144:9IuOkoX33WyZEwtWNRByDlPdOT6ncZe9y:9XOkoXnLETNnypWYcZeI
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2003
InternalName: FileTreeDialog
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: FileTreeDialog Application
ProductVersion: 1, 0, 0, 1
FileDescription: FileTreeDialog MFC Application
OriginalFilename: FileTreeDialog.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.ajsw also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.34255736
FireEyeTrojan.GenericKD.34255736
McAfeeEmotet-FRI!B99FD7B2C166
VIPRETrojan.Win32.Generic!BT
K7AntiVirusTrojan ( 0056b6f11 )
BitDefenderTrojan.GenericKD.34255736
K7GWTrojan ( 0056b6f11 )
TrendMicroTROJ_GEN.R002C0DGU20
F-ProtW32/Emotet.AOC.gen!Eldorado
SymantecTrojan.Emotet
APEXMalicious
AvastWin32:BankerX-gen [Trj]
KasperskyBackdoor.Win32.Emotet.ajsw
AlibabaMalware:Win32/BankerX.be19a885
Ad-AwareTrojan.GenericKD.34255736
SophosTroj/Emotet-CKK
DrWebTrojan.DownLoader34.9808
Invinceaheuristic
FortinetW32/GenKryptik.EOMR!tr
EmsisoftTrojan.Emotet (A)
IkarusTrojan-Banker.Emotet
CyrenW32/Emotet.AOC.gen!Eldorado
MAXmalware (ai score=81)
ArcabitTrojan.Generic.D20AB378
ZoneAlarmBackdoor.Win32.Emotet.ajsw
MicrosoftTrojan:Win32/Emotet.ARJ!MTB
AhnLab-V3Trojan/Win32.Emotet.R346328
ALYacTrojan.GenericKD.34255736
MalwarebytesTrojan.MalPack.TRE
PandaTrj/Emotet.C
ESET-NOD32a variant of Win32/Kryptik.HFGD
TrendMicro-HouseCallTROJ_GEN.R002C0DGU20
RisingTrojan.Kryptik!1.C89F (CLOUD)
GDataTrojan.GenericKD.34255736
AVGWin32:BankerX-gen [Trj]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Generic/Trojan.e03

How to remove Backdoor.Win32.Emotet.ajsw?

Backdoor.Win32.Emotet.ajsw removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment