Backdoor.Win32.Mokes.aipc (file analysis)

The Backdoor.Win32.Mokes.aipc is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Mokes.aipc virus can do?

Executable code extraction
Creates RWX memory
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Executed a very long command line or script command which may be indicative of chained commands or obfuscation
A scripting utility was executed
Attempts to repeatedly call a single API many times in order to delay analysis time
Attempts to execute a powershell command with suspicious parameter/s
Creates a hidden or system file

Related domains:

z.whorecord.xyz

a.tomx.xyz

paste.ee

How to determine Backdoor.Win32.Mokes.aipc?


File Info:
crc32: 72EBF612
md5: 0ed097ff6b1d3ba66e57f7e76659e714
name: chuc.exe
sha1: 1cf870b23fc7ebb91f3d945c6d38be0fdf3b900c
sha256: 37ae090d016c9d263e77f6f48263ba5c34f9b46e90a9ec2ded160060d776632c
sha512: 9d931ed6efdb3d10f37e305ad9a3c7ef28079255be6e5518f6074e8bfcec9f76f14cae106fcb66aec4b3518ddac065f9b5649dfc5503f485f3f09af42abb3577
ssdeep: 24576:xAHnh+eWsN3skA4RV1Hom2KXMmHaB1O5:Ih+ZkldoPK8YaBG
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0809 0x04b0

Backdoor.Win32.Mokes.aipc also known as:

Bkav	W32.AIDetectVM.malware2
FireEye	Generic.mg.0ed097ff6b1d3ba6
Cylance	Unsafe
Sangfor	Malware
Cybereason	malicious.23fc7e
Invincea	heuristic
APEX	Malicious
Kaspersky	Backdoor.Win32.Mokes.aipc
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.ch
MaxSecure	Trojan.Malware.300983.susgen
Ikarus	Trojan-Downloader.PowerShell.Agent
Webroot	W32.Malware.Gen
Endgame	malicious (high confidence)
ZoneAlarm	Backdoor.Win32.Mokes.aipc
Microsoft	Trojan:Win32/Casur.A!cl
TACHYON	Trojan/W32.Povertel.866304.G
eGambit	Unsafe.AI_Score_77%
Qihoo-360	HEUR/QVM10.1.3627.Malware.Gen

How to remove Backdoor.Win32.Mokes.aipc?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Backdoor.Win32.Mokes.aipc (file analysis)