Backdoor

About “Backdoor.Win32.Emotet.baeg” infection

Malware Removal

The Backdoor.Win32.Emotet.baeg is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.Win32.Emotet.baeg virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Mimics the system’s user agent string for its own requests
  • Expresses interest in specific running processes
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Attempts to modify proxy settings

How to determine Backdoor.Win32.Emotet.baeg?


File Info:

crc32: A8580B79
md5: 93cc8b025e349d37a70038d45dc7c7f4
name: upload_file
sha1: 351f97a595cbc34becd82199abe9d268fb9fa0ee
sha256: a443388d26d0d1b783f37dcf1a54d60102a65062e5cdbc762a3efd2ae0ed58cb
sha512: 5d057aa4a4b9e04e7e64867fc84ae759106360d964d98dd0d7a128eb616db4778e7bc8f9a7c8373f0cdb6a3960811ffa23ec53d9c8d9ff58c4db34134e080b74
ssdeep: 6144:psAXvtkXZjPfQ72jfw9LZ3fUIKonW1WAEgjrqVWFH:pZftkJjXCU8Z3cfoIEqT
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2002
InternalName: DriveBrowsingTree
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: DriveBrowsingTree Application
ProductVersion: 1, 0, 0, 1
FileDescription: DriveBrowsingTree MFC Application
OriginalFilename: DriveBrowsingTree.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.baeg also known as:

BkavW32.AIDetectVM.malware2
DrWebTrojan.DownLoader34.14215
MicroWorld-eScanTrojan.GenericKDZ.69173
FireEyeGeneric.mg.93cc8b025e349d37
ALYacTrojan.GenericKDZ.69173
CylanceUnsafe
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKDZ.69173
K7GWRiskware ( 0040eff71 )
Invinceaheuristic
CyrenW32/Emotet.AOG.gen!Eldorado
SymantecML.Attribute.HighConfidence
TrendMicro-HouseCallTROJ_GEN.R002C0DH220
Paloaltogeneric.ml
GDataTrojan.GenericKDZ.69173
KasperskyBackdoor.Win32.Emotet.baeg
AlibabaTrojan:Win32/Emotet.41882e46
NANO-AntivirusTrojan.Win32.Kryptik.hpnoph
ViRobotTrojan.Win32.Emotet.401408.D
TencentMalware.Win32.Gencirc.10cde567
Ad-AwareTrojan.GenericKDZ.69173
SophosTroj/Emotet-CKO
F-SecureTrojan.TR/Crypt.Agent.amsxb
ZillyaBackdoor.Emotet.Win32.847
TrendMicroTROJ_GEN.R002C0DH220
EmsisoftTrojan.Emotet (A)
IkarusTrojan-Banker.Emotet
F-ProtW32/Emotet.AOG.gen!Eldorado
JiangminBackdoor.Emotet.pm
AviraTR/Crypt.Agent.amsxb
MAXmalware (ai score=84)
Antiy-AVLTrojan/Win32.SGeneric
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D10E35
ZoneAlarmBackdoor.Win32.Emotet.baeg
MicrosoftTrojan:Win32/Emotet.DGM!MTB
CynetMalicious (score: 85)
AhnLab-V3Trojan/Win32.Emotet.R346631
McAfeeEmotet-FRO!93CC8B025E34
TACHYONBanker/W32.Emotet.401408.R
VBA32BScope.Trojan.Emotet
MalwarebytesTrojan.Emotet
PandaTrj/Genetic.gen
APEXMalicious
ESET-NOD32a variant of Win32/Kryptik.HFHN
RisingTrojan.Kryptik!1.C82B (CLASSIC)
FortinetW32/GenKryptik.EPAZ!tr
WebrootW32.Trojan.Emotet
AVGWin32:Malware-gen
AvastWin32:Malware-gen
Qihoo-360Win32/Backdoor.628

How to remove Backdoor.Win32.Emotet.baeg?

Backdoor.Win32.Emotet.baeg removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment