Backdoor

Backdoor.Win32.Emotet.bztk removal

Malware Removal

The Backdoor.Win32.Emotet.bztk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.Win32.Emotet.bztk virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Mimics the system’s user agent string for its own requests
  • Expresses interest in specific running processes
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Russian
  • Anomalous binary characteristics

How to determine Backdoor.Win32.Emotet.bztk?


File Info:

crc32: 4D6337E3
md5: f2054d95fe2672a73c760622bc51e322
name: upload_file
sha1: f4892a474b6f9be1c52ecfee2415acef943b2555
sha256: d7cacea124baaa20f7e9213d4c6aa4272970f31b66a92c2b0e73fbe17a609c22
sha512: 314a52d218c242b68a8707ca63dce9ec8cb95c1373ef4dc08de4c7910b791a5718cbd871116e909dea5bef4fd9e87275ca1b07e47d0bb9d0a2ec9fde588297a2
ssdeep: 3072:4pocVfb++Xuy7YXDxaOhlS7pkxno3mOuTb4vMDc3Ncg/5Z0dKekyOI:mDZ++eNTxytkucbGMsGS5
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2002
InternalName: ExpCheckTest
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: ExpCheckTest Application
ProductVersion: 1, 0, 0, 1
FileDescription: ExpCheckTest MFC Application
OriginalFilename: ExpCheckTest.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.bztk also known as:

Elasticmalicious (high confidence)
DrWebTrojan.Emotet.1000
MicroWorld-eScanTrojan.GenericKDZ.69449
FireEyeGeneric.mg.f2054d95fe2672a7
CAT-QuickHealTrojan.CKGENERIC
McAfeeEmotet-FQS!F2054D95FE26
MalwarebytesTrojan.MalPack.TRE
VIPRETrojan.Win32.Generic!BT
CrowdStrikewin/malicious_confidence_60% (W)
BitDefenderTrojan.GenericKDZ.69449
K7GWTrojan ( 0056c87c1 )
K7AntiVirusTrojan ( 0056c87c1 )
TrendMicroTrojanSpy.Win32.EMOTET.THHAEBO
CyrenW32/Emotet.APS.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:BankerX-gen [Trj]
ClamAVWin.Packed.Emotet-9371538-0
KasperskyBackdoor.Win32.Emotet.bztk
AlibabaTrojan:Win32/Emotet.767f128b
ViRobotTrojan.Win32.Emotet.188416.B
RisingTrojan.Emotet!8.B95 (CLOUD)
Ad-AwareTrojan.GenericKDZ.69449
Comodo.UnclassifiedMalware@0
F-SecureTrojan.TR/Crypt.Agent.xenbu
ZillyaBackdoor.Emotet.Win32.1035
SophosTroj/Emotet-CLB
JiangminBackdoor.Emotet.qv
MaxSecureTrojan.Malware.105305510.susgen
AviraTR/Crypt.Agent.xenbu
MAXmalware (ai score=83)
Antiy-AVLTrojan[Backdoor]/Win32.Emotet
MicrosoftTrojan:Win32/Emotet.ARJ!MTB
ArcabitTrojan.Generic.D10F49
ZoneAlarmBackdoor.Win32.Emotet.bztk
GDataTrojan.GenericKDZ.69449
CynetMalicious (score: 85)
AhnLab-V3Trojan/Win32.Emotet.R348051
VBA32Backdoor.Emotet
ALYacTrojan.GenericKDZ.69449
TACHYONBackdoor/W32.Emotet.188416
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/Kryptik.HFMZ
TrendMicro-HouseCallTrojanSpy.Win32.EMOTET.THHAEBO
TencentMalware.Win32.Gencirc.10cde85d
IkarusTrojan-Banker.Emotet
FortinetW32/Kryptik.HCEJ!tr
AVGWin32:BankerX-gen [Trj]
Paloaltogeneric.ml
Qihoo-360Generic/Trojan.c2a

How to remove Backdoor.Win32.Emotet.bztk?

Backdoor.Win32.Emotet.bztk removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment