Backdoor.Win32.Emotet.cffz (file analysis)

The Backdoor.Win32.Emotet.cffz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Emotet.cffz virus can do?

Executable code extraction
Creates RWX memory
Mimics the system’s user agent string for its own requests
Expresses interest in specific running processes
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Russian
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.Win32.Emotet.cffz?


File Info:
crc32: C39FB958
md5: 2bbde9b97f8fa75e7f96a3e6be1f37d9
name: upload_file
sha1: c880538a59f451238f298f37535f94a96ead31bd
sha256: a39100a9b6a8ec570861880459f3bbaf19b187a00ff6b647a289b7ded7683643
sha512: cd6e6d672f615c1efb14cd76131bcaf164d3ffa9acfbe013a9cb8f53b001380386c411de788cc3d1c42be6834b5dbb4d322cb3a798e770799f18475a0e6e10c4
ssdeep: 12288:cZlyqwEmkmauSVd2R3R0EcX0euXBQsTsU3z431xVB:Cm6whk90B4ye1T
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2002
InternalName: ExpCheckTest
FileVersion: 1, 0, 0, 1
CompanyName: 
LegalTrademarks: 
ProductName: ExpCheckTest Application
ProductVersion: 1, 0, 0, 1
FileDescription: ExpCheckTest MFC Application
OriginalFilename: ExpCheckTest.EXE
Translation: 0x0409 0x04b0

Backdoor.Win32.Emotet.cffz also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.EVAU
FireEye	Generic.mg.2bbde9b97f8fa75e
ALYac	Trojan.Agent.EVAU
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Generic.4!c
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.Agent.EVAU
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_60% (W)
Cyren	W32/Emotet.APV.gen!Eldorado
Symantec	Trojan.Emotet
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Backdoor.Win32.Emotet.cffz
Alibaba	Trojan:Win32/Emotet.ac4277af
Tencent	Malware.Win32.Gencirc.10cde812
Ad-Aware	Trojan.Agent.EVAU
Emsisoft	Trojan.Emotet (A)
F-Secure	Trojan.TR/Kryptik.oftex
DrWeb	Trojan.Emotet.999
Zillya	Backdoor.Emotet.Win32.1006
TrendMicro	TrojanSpy.Win32.EMOTET.THHAEBO
Sophos	Troj/Emotet-CLB
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.re
Avira	TR/Kryptik.oftex
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Emotet
Microsoft	Trojan:Win32/Emotet.ARK!MTB
Arcabit	Trojan.Agent.EVAU
ZoneAlarm	Backdoor.Win32.Emotet.cffz
GData	Trojan.Agent.EVAU
AhnLab-V3	Trojan/Win32.Emotet.R348048
McAfee	Emotet-FQS!2BBDE9B97F8F
TACHYON	Trojan/W32.Agent.917504.KO
Malwarebytes	Trojan.Emotet
Panda	Trj/Genetic.gen
ESET-NOD32	Win32/Emotet.CD
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.SMTHC
Rising	Trojan.Emotet!8.B95 (CLOUD)
MaxSecure	Trojan.Malware.105306793.susgen
Fortinet	PossibleThreat.MU
BitDefenderTheta	Gen:NN.ZexaE.34186.4y0@aerYnodk
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Generic/Trojan.357

How to remove Backdoor.Win32.Emotet.cffz?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.Win32.Emotet.cffz (file analysis)