Backdoor

Backdoor.Win32.Emotet.bpfq removal

Malware Removal

The Backdoor.Win32.Emotet.bpfq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.Win32.Emotet.bpfq virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Mimics the system’s user agent string for its own requests
  • Expresses interest in specific running processes
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.

How to determine Backdoor.Win32.Emotet.bpfq?


File Info:

crc32: A04B677A
md5: 475fb732faa9a63303f05b4f9ddeec40
name: upload_file
sha1: a9710528fd4bf9032de6c6340bee07fad4cb3194
sha256: 6c29dfcd40f96e2985a501099f61c779377ac9aaa15afe4945595c9c9063ee65
sha512: 819e88a42acae571c1b0fd5f506363c994ca925f5810e2a8bf73c870a7198b66ff384a26d630d3f4ac54291bdc50b4c7cde9a0d120437b12f9c5fd51fa9b0ae5
ssdeep: 1536:c2nOIwpOrHswqSOjnTwZa8eYefjPCoAxsuR7fxGW:c2xgQtqSOjnTwI8eXj6R74
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2002
InternalName: rcversion
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: rcversion Application
ProductVersion: 1, 0, 0, 1
FileDescription: rcversion MFC Application
OriginalFilename: rcversion.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.bpfq also known as:

BkavW32.AIDetectVM.malware2
DrWebTrojan.DownLoader34.21865
MicroWorld-eScanTrojan.GenericKD.34340063
FireEyeGeneric.mg.475fb732faa9a633
ALYacTrojan.GenericKD.34340063
K7AntiVirusTrojan ( 00565dfa1 )
K7GWTrojan ( 00565dfa1 )
Invinceaheuristic
F-ProtW32/Kryptik.BTH.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
GDataTrojan.GenericKD.34340063
KasperskyBackdoor.Win32.Emotet.bpfq
BitDefenderTrojan.GenericKD.34340063
TencentWin32.Backdoor.Emotet.Pcjf
Ad-AwareTrojan.GenericKD.34340063
EmsisoftTrojan.Emotet (A)
F-SecureTrojan.TR/Kryptik.sjyde
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R002C0DHC20
Trapminemalicious.moderate.ml.score
SophosTroj/Emotet-CKX
IkarusTrojan-Banker.Emotet
CyrenW32/Kryptik.BTH.gen!Eldorado
AviraTR/Kryptik.sjyde
ArcabitTrojan.Generic.D20BFCDF
ZoneAlarmBackdoor.Win32.Emotet.bpfq
MicrosoftTrojan:Win32/Emotet.ARJ!MTB
CynetMalicious (score: 90)
AhnLab-V3Trojan/Win32.Kryptik.R347569
McAfeeEmotet-FRT!475FB732FAA9
MAXmalware (ai score=84)
MalwarebytesTrojan.MalPack.TRE
ESET-NOD32a variant of Win32/Kryptik.HFMI
TrendMicro-HouseCallTROJ_GEN.R002C0DHC20
RisingDownloader.Obfuse!8.105AD (TFE:dGZlOgXGtUlfUOqTbA)
FortinetPossibleThreat.MU
AVGWin32:CrypterX-gen [Trj]
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Backdoor.Win32.Emotet.bpfq?

Backdoor.Win32.Emotet.bpfq removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment