Backdoor.Win32.Konus.pef removal

Malware Removal

The Backdoor.Win32.Konus.pef is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Backdoor.Win32.Konus.pef virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Starts servers listening on 127.0.0.1:32767, 127.0.0.1:32768
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Looks up the external IP address
  • Queries information on disks, possibly for anti-virtualization
  • Sniffs keystrokes

Related domains:

z.whorecord.xyz
api.ipify.org
time-a.nist.gov
time-a-g.nist.gov
a.tomx.xyz

How to determine Backdoor.Win32.Konus.pef?


File Info:

crc32: CC88A830
md5: 556c756b428b0a6f1516de031c3bfdb3
name: 556C756B428B0A6F1516DE031C3BFDB3.mlw
sha1: d4a8195611ac93a268b0ebdc14319a75de856725
sha256: 6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239
sha512: 0e6ffc8dd5dda62a3936a5ea311a9e7007f27ead2f86f9f3f17510a78d2181b16473c69b3b5aa465f68042adef0d95fa8403f9d5bb106dbb4896750caef60a26
ssdeep: 12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuh:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNb7
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Backdoor.Win32.Konus.pef also known as:

K7AntiVirusSpyware ( 00539c471 )
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Banker1.36840
CynetMalicious (score: 100)
ALYacGen:Heur.Mint.Zard.25
CylanceUnsafe
ZillyaBackdoor.Konus.Win32.70
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_70% (W)
K7GWSpyware ( 00539c471 )
Cybereasonmalicious.b428b0
CyrenW32/Konus.A.gen!Eldorado
ESET-NOD32a variant of Win32/Spy.Kronosbot.A
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Trojan.Konus-9880448-0
KasperskyHEUR:Backdoor.Win32.Konus.pef
BitDefenderGen:Heur.Mint.Zard.25
NANO-AntivirusTrojan.Win32.Konus.ilrxvn
MicroWorld-eScanGen:Heur.Mint.Zard.25
TencentMalware.Win32.Gencirc.10ce757a
Ad-AwareGen:Heur.Mint.Zard.25
SophosTroj/Konus-A
BitDefenderThetaAI:Packer.CF7A767B1E
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Generic.gc
FireEyeGeneric.mg.556c756b428b0a6f
EmsisoftGen:Heur.Mint.Zard.25 (B)
SentinelOneStatic AI – Suspicious PE
JiangminBackdoor.Konus.ch
AviraHEUR/AGEN.1116604
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Generic.ASMalwS.315141A
MicrosoftBackdoor:Win32/Konus.A
GridinsoftTrojan.Win32.Agent.oa!s1
GDataGen:Heur.Mint.Zard.25
AhnLab-V3Trojan/Win32.RL_Banker.R277924
Acronissuspicious
McAfeeGenericRXNP-XC!556C756B428B
MAXmalware (ai score=83)
VBA32TScope.Malware-Cryptor.SB
MalwarebytesTrojan.MalPack
PandaTrj/GdSda.A
TrendMicro-HouseCallTROJ_GEN.R06CC0DIJ21
RisingBackdoor.Kronos!1.D39A (CLASSIC)
YandexTrojanSpy.Kronosbot!nSbrWjCqYHY
IkarusTrojan.Win32.Agent
FortinetW32/Kronosbot.A!tr
AVGWin32:Trojan-gen

How to remove Backdoor.Win32.Konus.pef?

Backdoor.Win32.Konus.pef removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment