Backdoor.Win32.Emotet.caxu (file analysis)

The Backdoor.Win32.Emotet.caxu is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Emotet.caxu virus can do?

Executable code extraction
Creates RWX memory
Mimics the system’s user agent string for its own requests
Expresses interest in specific running processes
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Russian
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Win32.Emotet.caxu?


File Info:
crc32: 069F6E47
md5: bed52d8db576cd9d0f9056a730c22584
name: upload_file
sha1: 2d027187531b23148ce2a78c26700f9769944203
sha256: e39c19ea4c4679c93e1df25709c11075e90edf42c80789dcf234e97561761e85
sha512: c7996e54c24a8f67c5757c5dd1c56496f6b24ceb8c7138bf8c73787fa6717617a24a9ea80feb0415815cb3238c201dea0306b55850c1c22e67fb332ae9b866b1
ssdeep: 6144:X4m/apJdyV8fDpf8SAGGwGGGGi/cNmGzc3A6431xVMe:j/aPdIsU3z431xVh
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2002
InternalName: ExpCheckTest
FileVersion: 1, 0, 0, 1
CompanyName: 
LegalTrademarks: 
ProductName: ExpCheckTest Application
ProductVersion: 1, 0, 0, 1
FileDescription: ExpCheckTest MFC Application
OriginalFilename: ExpCheckTest.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.caxu also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.Emotet.999
MicroWorld-eScan	Trojan.GenericKDZ.69452
FireEye	Trojan.GenericKDZ.69452
CAT-QuickHeal	Trojan.CKGENERIC
McAfee	Emotet-FQS!BED52D8DB576
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKDZ.69452
K7GW	Riskware ( 0040eff71 )
TrendMicro	TROJ_GEN.R011C0DHF20
Cyren	W32/Emotet.APS.gen!Eldorado
Symantec	Trojan.Emotet
TrendMicro-HouseCall	TROJ_GEN.R011C0DHF20
Avast	Win32:Trojan-gen
Kaspersky	Backdoor.Win32.Emotet.caxu
Alibaba	Trojan:Win32/Emotet.3b9fcf54
Rising	Trojan.Kryptik!1.CA84 (CLOUD)
Ad-Aware	Trojan.GenericKDZ.69452
Sophos	Troj/Emotet-CLB
Comodo	.UnclassifiedMalware@0
Zillya	Backdoor.Emotet.Win32.1042
Emsisoft	Trojan.Emotet (A)
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.qw
MaxSecure	Trojan.Malware.105305613.susgen
Avira	TR/Emotet.lhhsh
MAX	malware (ai score=86)
Antiy-AVL	Trojan/Win32.Emotet
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
Arcabit	Trojan.Generic.D10F4C
ZoneAlarm	Backdoor.Win32.Emotet.caxu
GData	Trojan.GenericKDZ.69452
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Emotet.R348050
ALYac	Trojan.Agent.Emotet
TACHYON	Trojan/W32.Agent.397312.AAB
Malwarebytes	Trojan.MalPack.TRE
Panda	Trj/Genetic.gen
APEX	Malicious
ESET-NOD32	Win32/Emotet.CD
Tencent	Malware.Win32.Gencirc.10cde819
Fortinet	W32/Emotet.E88D!tr
AVG	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Generic/HEUR/QVM41.2.3DFB.Malware.Gen

How to remove Backdoor.Win32.Emotet.caxu?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.Win32.Emotet.caxu (file analysis)