Backdoor

Backdoor.Win32.Mokes.anrq malicious file

Malware Removal

The Backdoor.Win32.Mokes.anrq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.Win32.Mokes.anrq virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process created a hidden window
  • Unconventionial language used in binary resources: Kannada
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Detects Sandboxie through the presence of a library
  • Detects Avast Antivirus through the presence of a library
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

How to determine Backdoor.Win32.Mokes.anrq?


File Info:

crc32: E56C0A33
md5: 477d9ca5815a428534936f5592481c69
name: 477D9CA5815A428534936F5592481C69.mlw
sha1: 2dc0f990f556f435e4c63d89972e7eace26eded4
sha256: 135b2bf89205cffb1755a568609aea5c37319dd8fa5a7c5b1cda49e7eaa1313a
sha512: 5c5873998badd9ec20f8a50ad9d4f19ee171da1f038a13e55d1c295f687adb9e4e747f81ca46e92b2d9bf04375b592247b769bee1cc60443fdfa58c19a1c6691
ssdeep: 3072:L9ItknVm57fb/1dj3Kl4r3SXg0/+SREgM3:jM7fb/GlpgGega
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

InternalName: bomgpiaruci.iwa
ProductVersion: 15.54.32.51
Copyright: Copyrighz (C) 2021, fudkagat
Translation: 0x0115 0x0456

Backdoor.Win32.Mokes.anrq also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 00589c9c1 )
LionicTrojan.Win32.SmartFortress.lEDV
Elasticmalicious (high confidence)
DrWebTrojan.Siggen15.33262
CynetMalicious (score: 100)
ALYacGen:Variant.Fragtor.37347
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaBackdoor:Win32/Mokes.a2263f85
K7GWTrojan ( 00589c9c1 )
Cybereasonmalicious.0f556f
CyrenW32/Kryptik.FOQ.gen!Eldorado
SymantecPacked.Generic.528
ESET-NOD32a variant of Win32/Kryptik.HNDU
APEXMalicious
AvastWin32:CrypterX-gen [Trj]
KasperskyBackdoor.Win32.Mokes.anrq
BitDefenderGen:Heur.Mint.Titirez.ju0@i5D7bgpG
MicroWorld-eScanGen:Heur.Mint.Titirez.ju0@i5D7bgpG
Ad-AwareGen:Heur.Mint.Titirez.ju0@i5D7bgpG
SophosMal/Generic-R + Troj/Krypt-BO
BitDefenderThetaGen:NN.ZexaF.34236.ju0@a4D7bgpG
TrendMicroTROJ_GEN.R03BC0RK221
McAfee-GW-EditionBehavesLike.Win32.Trojan.ch
FireEyeGeneric.mg.477d9ca5815a4285
EmsisoftTrojan.Crypt (A)
SentinelOneStatic AI – Malicious PE
AviraTR/AD.MalwareCrypter.mhwzk
eGambitUnsafe.AI_Score_99%
MicrosoftTrojan:Win32/Azorult.RT!MTB
GDataGen:Heur.Mint.Titirez.ju0@i5D7bgpG
AhnLab-V3Infostealer/Win.SmokeLoader.R448265
Acronissuspicious
McAfeeGenericRXQO-MO!477D9CA5815A
MAXmalware (ai score=87)
VBA32Malware-Cryptor.2LA.gen
MalwarebytesTrojan.MalPack.GS
PandaTrj/GdSda.A
RisingTrojan.Kryptik!1.DA22 (CLASSIC)
IkarusTrojan.Win32.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GenKryptik.FMYB!tr
AVGWin32:CrypterX-gen [Trj]
Paloaltogeneric.ml

How to remove Backdoor.Win32.Mokes.anrq?

Backdoor.Win32.Mokes.anrq removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment