About "Backdoor.Win32.Emotet.cdux" infection

The Backdoor.Win32.Emotet.cdux is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Emotet.cdux virus can do?

Executable code extraction
Creates RWX memory
Mimics the system’s user agent string for its own requests
Expresses interest in specific running processes
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Russian
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Win32.Emotet.cdux?


File Info:
crc32: 3EF5B40A
md5: c273b9675a61d27f9d61beb1eb30a32d
name: upload_file
sha1: bbd8c18cf6bd214c6999141fc1ca0ba2bed65893
sha256: 561d72d9b9516c155bb720f2dfe91768a7ae160a16ad5635344353b0275d951d
sha512: 7d833e091237a28b9a33a9c50708e2f32227b2842cd0105d4896d3ba3a0384aacdcdbbab97170be7bd76c0fe6587bc64c7143c38a08ce2a2175671e768700a00
ssdeep: 12288:6ZlyqwEmkmauSVd2R3R0EcX0euXBzsQsU3z4ZuF:wm6whk90B2yQ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2002
InternalName: ExpCheckTest
FileVersion: 1, 0, 0, 1
CompanyName: 
LegalTrademarks: 
ProductName: ExpCheckTest Application
ProductVersion: 1, 0, 0, 1
FileDescription: ExpCheckTest MFC Application
OriginalFilename: ExpCheckTest.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.cdux also known as:

Bkav	W32.AIDetectVM.malware2
MicroWorld-eScan	Trojan.Agent.EVAU
FireEye	Generic.mg.c273b9675a61d27f
BitDefender	Trojan.Agent.EVAU
K7GW	Riskware ( 0040eff71 )
APEX	Malicious
Kaspersky	Backdoor.Win32.Emotet.cdux
Ad-Aware	Trojan.Agent.EVAU
DrWeb	Trojan.Emotet.999
Sophos	Troj/Emotet-CLB
Arcabit	Trojan.Agent.EVAU
Microsoft	Trojan:Win32/Emotet.ARK!MTB
McAfee	Emotet-FQS!C273B9675A61
MAX	malware (ai score=83)
Malwarebytes	Trojan.Emotet
ESET-NOD32	a variant of Win32/GenKryptik.EQKW
GData	Trojan.Agent.EVAU
BitDefenderTheta	Gen:NN.ZexaE.34152.4y0@aC8yHwbk
Qihoo-360	Win32/Backdoor.ca6

How to remove Backdoor.Win32.Emotet.cdux?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Backdoor.Win32.Emotet.cdux” infection