Backdoor.Win32.Emotet.bain malicious file

The Backdoor.Win32.Emotet.bain is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Emotet.bain virus can do?

Executable code extraction
Creates RWX memory
Mimics the system’s user agent string for its own requests
Expresses interest in specific running processes
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Win32.Emotet.bain?


File Info:
crc32: EC0D665A
md5: ab32c87934544159b6526af74ede5856
name: upload_file
sha1: d7124c3678ea3a5781de6426404a28778214d51f
sha256: bbd0161f437da1bb17688d06fbb82df750dbdc7088cbb8225312eddf12609828
sha512: 9a922ddd7fa8fce9623d11159f19db7de8ed5c0a043f64fda0ab1cdab424137b5f9c18a7bb4e593b4daada957a6c4b3af71ccd284fed405d4f971e7e997182bc
ssdeep: 6144:gsAXvtkXZjPfQ72jfw9LZ3fUIKonW1WAEgjrqVdFH:gZftkJjXCU8Z3cfoIEqW
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2002
InternalName: DriveBrowsingTree
FileVersion: 1, 0, 0, 1
CompanyName: 
LegalTrademarks: 
ProductName: DriveBrowsingTree Application
ProductVersion: 1, 0, 0, 1
FileDescription: DriveBrowsingTree MFC Application
OriginalFilename: DriveBrowsingTree.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.bain also known as:

Bkav	W32.AIDetectVM.malware2
MicroWorld-eScan	Trojan.GenericKDZ.69173
FireEye	Generic.mg.ab32c87934544159
McAfee	Emotet-FRO!AB32C8793454
Cylance	Unsafe
BitDefender	Trojan.GenericKDZ.69173
K7GW	Riskware ( 0040eff71 )
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
GData	Trojan.GenericKDZ.69173
Kaspersky	Backdoor.Win32.Emotet.bain
AegisLab	Trojan.Win32.Generic.4!c
Tencent	Win32.Backdoor.Emotet.Lmuc
Endgame	malicious (high confidence)
Emsisoft	Trojan.GenericKDZ.69173 (B)
F-Secure	Trojan.TR/Crypt.Agent.uxmdd
DrWeb	Trojan.DownLoader34.14215
TrendMicro	TROJ_GEN.R06BC0DH220
Sophos	Troj/Emotet-CKO
Cyren	W32/Trojan.GMGU-2648
Webroot	W32.Trojan.Emotet
Avira	TR/Crypt.Agent.uxmdd
MAX	malware (ai score=86)
Arcabit	Trojan.Generic.D10E35
ZoneAlarm	Backdoor.Win32.Emotet.bain
Microsoft	Trojan:Win32/Emotet.DGM!MTB
Cynet	Malicious (score: 85)
VBA32	BScope.Trojan.Emotet
ALYac	Trojan.GenericKDZ.69173
Ad-Aware	Trojan.GenericKDZ.69173
Malwarebytes	Trojan.Emotet
ESET-NOD32	a variant of Win32/Kryptik.HFHN
TrendMicro-HouseCall	TROJ_GEN.R06BC0DH220
Rising	Trojan.Kryptik!1.C82B (CLOUD)
Fortinet	W32/GenKryptik.EPAZ!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Backdoor.dcf

How to remove Backdoor.Win32.Emotet.bain?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.Win32.Emotet.bain malicious file