Backdoor.Win32.Mokes.aosh information

The Backdoor.Win32.Mokes.aosh is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Mokes.aosh virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Sanskrit
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Detects Sandboxie through the presence of a library
• Detects Avast Antivirus through the presence of a library
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Checks the presence of disk drives in the registry, possibly for anti-virtualization

How to determine Backdoor.Win32.Mokes.aosh?

File Info:
name: 67D5F5AADEF91B7782B4.mlw
path: /opt/CAPEv2/storage/binaries/2daf6c050d4add09f05d295dd8ba9d7b013b20ca7d6052929ef9322d0b261ab3
crc32: E6071517
md5: 67d5f5aadef91b7782b48f6d9e5b636a
sha1: 9a0a4460d7657d4e3c418999483b38aa77a125a8
sha256: 2daf6c050d4add09f05d295dd8ba9d7b013b20ca7d6052929ef9322d0b261ab3
sha512: 7674a3fa5026b3184ba04f98458c591bc3c99759d745416628737a0a419482162cba60e1998873422d33b88eb57c7060ad17ec9abe0830a8ec59e4b7aa5abd06
ssdeep: 6144:H/ymabBRWGu8XXuUIrCSCg7ITsq9wVfG:H/ym6BRWt8K2Sd7Y
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15354CED0B6F0D8B6C68632718856CFE1ABFAA836D66485073734676E1E733C09633356
sha3_384: bb2d7325cef542688773ffdadb873269b0d023e14e6130c2c3a52fc08c4dd9b048857f02acff34f293b17c8d16e352d8
ep_bytes: e8425d0000e978feffff8325048e4300
timestamp: 2021-05-04 21:11:08

Version Info:
FileVersion: 21.29.11.69
InternationalName: bomgveoci.iwa
Copyright: Copyrighz (C) 2021, fudkorta
ProjectVersion: 1.10.74.57
Translations: 0x0121 0x03ca

Backdoor.Win32.Mokes.aosh also known as:

How to remove Backdoor.Win32.Mokes.aosh?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.