Backdoor

Backdoor.Win32.Emotet.bajb (file analysis)

Malware Removal

The Backdoor.Win32.Emotet.bajb is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.Win32.Emotet.bajb virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Mimics the system’s user agent string for its own requests
  • Expresses interest in specific running processes
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Attempts to modify proxy settings

How to determine Backdoor.Win32.Emotet.bajb?


File Info:

crc32: 88B315E4
md5: d75b98ca0d107b255c80995613cef5da
name: upload_file
sha1: 68fdc992f9d94b2bb46452fcede6e85717fa59c5
sha256: 2118e4d23251b16876fc5becc5f68a5a7e8fee9bfb22debcad7ecf0ad4bca083
sha512: e7ad2fae82744c28eaf33054cb51d98cf2e6d87dfa91e4578454091eaddb209b04d2c844acfad7eeac4adb37f97493c4bd7e6ed04078da9c6df45ad5af75c7ab
ssdeep: 6144:fsAXvtkXZjPfQ72jfw9LZ3fUIKonW1WAEgjrqVbFH:fZftkJjXCU8Z3cfoIEq0
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2002
InternalName: DriveBrowsingTree
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: DriveBrowsingTree Application
ProductVersion: 1, 0, 0, 1
FileDescription: DriveBrowsingTree MFC Application
OriginalFilename: DriveBrowsingTree.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.bajb also known as:

BkavW32.AIDetectVM.malware2
MicroWorld-eScanTrojan.GenericKD.43587303
FireEyeGeneric.mg.d75b98ca0d107b25
ALYacTrojan.GenericKD.43587303
CylanceUnsafe
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKD.43587303
K7GWRiskware ( 0040eff71 )
Invinceaheuristic
CyrenW32/Emotet.AOG.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Malware-gen
GDataTrojan.GenericKD.43587303
KasperskyBackdoor.Win32.Emotet.bajb
AlibabaTrojan:Win32/Emotet.0c9c3224
NANO-AntivirusTrojan.Win32.Kryptik.hpnoph
ViRobotTrojan.Win32.Emotet.401408.D
AegisLabTrojan.Win32.Generic.4!c
TencentMalware.Win32.Gencirc.10cde567
Ad-AwareTrojan.GenericKD.43587303
SophosTroj/Emotet-CKO
F-SecureTrojan.TR/Crypt.Agent.smqrk
DrWebTrojan.DownLoader34.14215
ZillyaBackdoor.Emotet.Win32.847
TrendMicroTROJ_GEN.R06BC0DH220
EmsisoftTrojan.Emotet (A)
IkarusTrojan-Banker.Emotet
F-ProtW32/Emotet.AOG.gen!Eldorado
JiangminBackdoor.Emotet.pm
WebrootW32.Trojan.Emotet
AviraTR/Crypt.Agent.smqrk
MAXmalware (ai score=84)
Antiy-AVLTrojan/Win32.SGeneric
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D29916E7
ZoneAlarmBackdoor.Win32.Emotet.bajb
MicrosoftTrojan:Win32/Emotet.DGM!MTB
CynetMalicious (score: 85)
AhnLab-V3Trojan/Win32.Emotet.R346631
McAfeeEmotet-FRO!D75B98CA0D10
VBA32BScope.Trojan.Emotet
MalwarebytesTrojan.Emotet
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/Kryptik.HFHN
TrendMicro-HouseCallTROJ_GEN.R06BC0DH220
RisingTrojan.Kryptik!1.C82B (CLOUD)
FortinetW32/GenKryptik.EPAZ!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml

How to remove Backdoor.Win32.Emotet.bajb?

Backdoor.Win32.Emotet.bajb removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment