Categories: Backdoor

Backdoor.Win32.Plite.bhuh removal instruction

The Backdoor.Win32.Plite.bhuh is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Plite.bhuh virus can do?

Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Anomalous binary characteristics

How to determine Backdoor.Win32.Plite.bhuh?


File Info:
name: FEBA308E830B6C94EF80.mlwpath: /opt/CAPEv2/storage/binaries/4f9e416df7e2ec12a173e419f300b61985af66e1929d460ad6108318b49941f5crc32: E56183B9md5: feba308e830b6c94ef804ccca06da496sha1: 7c9dea60b3c7b11232ac3d0eb65d3b84a1a1ec97sha256: 4f9e416df7e2ec12a173e419f300b61985af66e1929d460ad6108318b49941f5sha512: 9e1b4cc0139716a2e38bea43fd10f77221e791e80e4e14198ae225dc95f45c599294ca1f45b91a3253f51789fc7daebc153ea70c716f970505dc0d1a5623d6fessdeep: 1536:hiVlUPlfHeARjOsOAe2zBN7lE4U1sgzAom8JsuPIclSXsWjcdd6YGxjvnYX:wVlUPZRxfxE9Vs5cfdd6YGxMXtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T181C36D00B6C58070E0B6023006959B21597DFD716BA99E9FB7C45D9ECA787C0BA31F7Bsha3_384: 6e0beea7d924b56822be85197c7e34e796465dd73226b08cda68d7b18220786eb75169346630d837ecba26400d805623ep_bytes: e8e55c0000e97ffeffff558bec5633f6timestamp: 2015-01-03 05:22:17
Version Info:
CompanyName: HYGSYGYDGWFileDescription: LophgdteFileVersion: 1.0.0.1InternalName: NigdtreLegalCopyright: Copyright (C) biydtfrerOriginalFilename: Biohdgtre.exeProductName: VUSDRRWDTWDProductVersion: 1.0.0.1Translation: 0x0409 0x04b0

Backdoor.Win32.Plite.bhuh also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.Mint.SP.Urelas.1
ClamAV	Win.Malware.Urelas-6717394-0
FireEye	Generic.mg.feba308e830b6c94
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	PWS-FDJS!FEBA308E830B
Cylance	Unsafe
VIPRE	Gen:Heur.Mint.SP.Urelas.1
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 005946341 )
K7AntiVirus	Trojan ( 005946341 )
Baidu	Win32.Trojan.Urelas.b
Cyren	W32/S-07a5605a!Eldorado
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Urelas.U
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Plite.bhuh
BitDefender	Gen:Heur.Mint.SP.Urelas.1
NANO-Antivirus	Trojan.Win32.Dwn.dhyuga
SUPERAntiSpyware	Trojan.Agent/Gen-Urelas
Avast	Win32:BackdoorX-gen [Trj]
Rising	Trojan.Urelas!1.BE13 (CLASSIC)
Ad-Aware	Gen:Heur.Mint.SP.Urelas.1
Emsisoft	Gen:Heur.Mint.SP.Urelas.1 (B)
Comodo	TrojWare.Win32.Urelas.SEE@5443e3
DrWeb	Trojan.DownLoader11.30256
Zillya	Trojan.Urelas.Win32.42293
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.ch
Trapmine	malicious.moderate.ml.score
Sophos	ML/PE-A + Troj/Urelas-Q
Ikarus	Trojan.Win32.Urelas
GData	Win32.Trojan.PSE.18NM1Y7
Jiangmin	Backdoor.Plite.pl
Avira	BDS/Backdoor.Gen7
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Generic.ASMalwS.51E9
Arcabit	Trojan.Mint.SP.Urelas.1
ZoneAlarm	Backdoor.Win32.Plite.bhuh
Microsoft	Trojan:Win32/Urelas.AA
Google	Detected
AhnLab-V3	Backdoor/Win.Plite.R508367
VBA32	SScope.Backdoor.Urelas.3114
Malwarebytes	Urelas.Spyware.Stealer.DDS
Tencent	Trojan.Win32.Urelas.16000161
Yandex	Trojan.GenAsa!k509nZCYe18
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Urelas.U!tr
BitDefenderTheta	Gen:NN.ZexaF.34754.hC1@a0K@e9ai
AVG	Win32:BackdoorX-gen [Trj]
Cybereason	malicious.e830b6
Panda	Trj/Genetic.gen