Categories: Backdoor

What is “Backdoor.Win32.Plite.bhtq”?

The Backdoor.Win32.Plite.bhtq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Plite.bhtq virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Korean
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities to create a scheduled task
Deletes executed files from disk

How to determine Backdoor.Win32.Plite.bhtq?


File Info:
name: EF5F1073CB87D93548A7.mlwpath: /opt/CAPEv2/storage/binaries/3618676d19fda35ef959660a882635118a752d868f6e091fdac876e9340b1032crc32: 1EDA6444md5: ef5f1073cb87d93548a7d0f922a4789asha1: f538addd8222e121e22ffaf3ed7753af83d444ccsha256: 3618676d19fda35ef959660a882635118a752d868f6e091fdac876e9340b1032sha512: 11002b10bc07bb5ee0292ad9b1e9ba1784ab3e0805b31c1b55185ef40ad2a6769b1ff955d6d6f219f075c8f95bb4ef382bc862982e22e32dd5aefd8831437778ssdeep: 12288:TeGtVfjTQSaoINAHT15lUSE0nF82EhLd1zXq2jb:TLt4/NA199a2Ed5type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B0C4AE1036908475F366273108A6E6F41AB97C384AA5E58FF7647E3A6E311D38A3734Fsha3_384: 783ba81c8933d5d6dd9f9ceb945145859837c1e2add7db8da14c46533d2363a68405821a5d563092d45d25b86b6e5728ep_bytes: e83fa40000e979feffff8bff558bec51timestamp: 2013-08-22 13:02:31
Version Info:
0: [No Data]

Backdoor.Win32.Plite.bhtq also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.lKG1
Elastic	malicious (high confidence)
DrWeb	Trojan.AVKill.32817
MicroWorld-eScan	MemScan:Trojan.GenericKDZ.96040
CAT-QuickHeal	Trojan.Gupboot.G.mue
ALYac	MemScan:Trojan.GenericKDZ.96040
Malwarebytes	CardSpy.Spyware.Stealer.DDS
VIPRE	MemScan:Trojan.GenericKDZ.96040
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Backdoor ( 0053e8561 )
Alibaba	Backdoor:Win32/Urelas.2eb2
K7GW	Trojan ( 0047e3691 )
Cybereason	malicious.3cb87d
BitDefenderTheta	Gen:NN.ZexaF.36196.HmX@aig8nraO
Cyren	W32/Urelas.E.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Urelas.S
APEX	Malicious
ClamAV	Win.Malware.Urelas-9655843-0
Kaspersky	Backdoor.Win32.Plite.bhtq
BitDefender	MemScan:Trojan.GenericKDZ.96040
NANO-Antivirus	Trojan.Win32.Plite.cvbpsw
ViRobot	Trojan.Win.Z.Urelas.549873.D
Avast	MBR:Plite-I [Rtk]
Tencent	Trojan.Win32.Urelas.16000132
Emsisoft	MemScan:Trojan.GenericKDZ.96040 (B)
F-Secure	Heuristic.HEUR/AGEN.1317509
Baidu	Win32.Rootkit.Agent.s
Zillya	Trojan.Urelas.Win32.42384
TrendMicro	TROJ_GEN.R002C0DEK23
McAfee-GW-Edition	BehavesLike.Win32.Corrupt.hh
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.ef5f1073cb87d935
Sophos	Troj/Urelas-Q
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE.110RWKI
Jiangmin	Backdoor.Generic.zjt
Avira	HEUR/AGEN.1317509
MAX	malware (ai score=86)
Antiy-AVL	GrayWare/Win32.Generic
Xcitium	TrojWare.Win32.GupBoot.SEH@56eidq
Arcabit	Trojan.Generic.D17728
ZoneAlarm	Backdoor.Win32.Plite.bhtq
Microsoft	Trojan:Win32/Urelas.AA
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Plite.R141230
Acronis	suspicious
McAfee	Corrupt-FY!EF5F1073CB87
VBA32	Backdoor.Plite
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R002C0DEK23
Rising	Trojan.Gupboot!1.9CEA (CLASSIC)
Yandex	Trojan.GenAsa!T9bs+ffsnlE
Ikarus	Trojan.Win32.Gupboot
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Urelas.BN!tr
AVG	MBR:Plite-I [Rtk]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)