Backdoor.Win32.Mokes.aigm malicious file

The Backdoor.Win32.Mokes.aigm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.Win32.Mokes.aigm virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Authenticode signature is invalid
CAPE detected the Salfram malware family

How to determine Backdoor.Win32.Mokes.aigm?


File Info:
name: F1F5F21C5E9E849BE241.mlw
path: /opt/CAPEv2/storage/binaries/3a6618e75f5a7c0686dd1d245383110a61893af7a6343fe55947a129bca5decc
crc32: FE3B1ECF
md5: f1f5f21c5e9e849be241d1e9472ab1ac
sha1: be32a6d10add09fec60fe380f2de071766705862
sha256: 3a6618e75f5a7c0686dd1d245383110a61893af7a6343fe55947a129bca5decc
sha512: 4ccff9d1d2c97ff98080fe0d3319922f3ebb2dd8a0dc78f44c16e94aedc6fa1591f49e1e221aceeaaf7ba4e9628892d362605293e88272e28986f156ed31dfbc
ssdeep: 1536:Dn/zMuzvkv+TDvWYasNqX69osR5lIZsvVRVfeQ95m:DnjvDhasUqzIWrfzm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FFA329B58F4DE343E58A66BBDE4D96013DB8D20C078662C72B9C210CE929FD4974E5E3
sha3_384: ae0e812a459be664e95686a8bd057a7477b3ee6cddae3512008b810a9a13307de1f8f10e261af8bacea165658d401b98
ep_bytes: e882220000e9fa1f0000f4f4f451e834
timestamp: 1970-01-01 00:00:00

Version Info:
FileVersion: 1, 8, 6, 6
CompanyName: Cultured Code GmbH & Co. KG
InternalName: nLhV oNfnajQw
PrivateBuild: dulJamCVX SyKuP
Translation: 0x0409 0x04e4

Backdoor.Win32.Mokes.aigm also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Mokes.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.47859699
FireEye	Generic.mg.f1f5f21c5e9e849b
McAfee	Trojan-FSXT!F1F5F21C5E9E
Cylance	Unsafe
Zillya	Backdoor.Mokes.Win32.2240
Sangfor	Backdoor.Win32.Mokes.aigm
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Backdoor:Win32/Mokes.64a4e5d9
K7GW	Trojan ( 00563ca31 )
K7AntiVirus	Trojan ( 00563ca31 )
BitDefenderTheta	AI:Packer.8CE884BA20
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packer.Salfram-9552985-0
Kaspersky	Backdoor.Win32.Mokes.aigm
BitDefender	Trojan.GenericKD.47859699
NANO-Antivirus	Trojan.Win32.Mokes.hhfspu
Avast	Win32:Malware-gen
Tencent	Win32.Backdoor.Mokes.Eegz
Ad-Aware	Trojan.GenericKD.47859699
Emsisoft	Trojan.GenericKD.47859699 (B)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PLK21
McAfee-GW-Edition	BehavesLike.Win32.Trojan.nh
Sophos	Mal/Generic-S
Ikarus	Trojan.ZLoader
GData	Trojan.GenericKD.47859699
Jiangmin	Backdoor.Mokes.cfe
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1207792
MAX	malware (ai score=83)
Arcabit	Trojan.Generic.D2DA47F3
ViRobot	Trojan.Win32.Z.Mokes.97792
ZoneAlarm	Backdoor.Win32.Mokes.aigm
Microsoft	Trojan:Win32/Occamy.C3A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Tiggre.R328848
Acronis	suspicious
ALYac	Trojan.GenericKD.47859699
TACHYON	Backdoor/W32.Mokes.97792
VBA32	BScope.TrojanPSW.Spy
Malwarebytes	Trojan.MalPack
TrendMicro-HouseCall	TROJ_GEN.R002C0PLK21
Rising	Backdoor.Mokes!8.619 (CLOUD)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.73415445.susgen
Fortinet	W32/Mokes.AIGM!tr.bdr
AVG	Win32:Malware-gen
Cybereason	malicious.c5e9e8
Panda	Trj/GdSda.A

How to remove Backdoor.Win32.Mokes.aigm?

Backdoor.Win32.Mokes.aigm removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X