Backdoor.Win32.Plite.bhuu (file analysis)

The Backdoor.Win32.Plite.bhuu is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.Plite.bhuu virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Attempts to connect to a dead IP:Port (4 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Korean
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Created a process from a suspicious location
• Anomalous binary characteristics

How to determine Backdoor.Win32.Plite.bhuu?

File Info:
name: 8969967685CFA0E65E38.mlw
path: /opt/CAPEv2/storage/binaries/2ad315d4afceb16fd20e9c596ff0fb83319c3737cbb406dc8924e88cef49f39b
crc32: 5305F524
md5: 8969967685cfa0e65e382f061cf28fc0
sha1: afa1cab571747d8ba3e890aaa6e107dd1a656ee9
sha256: 2ad315d4afceb16fd20e9c596ff0fb83319c3737cbb406dc8924e88cef49f39b
sha512: e41fe3d945745e686c244f6e6086d1efc685485f2f0be7f29b4e1fb4e04dd47264aa32fb0a557561065680c376679560c00306eba9d5fdec7617a38e404f1f47
ssdeep: 6144:EYbcV3nMtQxfYrkMV4UoPjXLodHUeGoCur259hhiAA8jpEpm:ErhkC+kJUy6XwurETAsh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19554F005A2210864FB4D1B72194BF9E0096A5E7C99C8F24FF63CBC3A28715D79AB314F
sha3_384: 895dc570b835a18b4cb8651f1803abf327612340fc5665b4cc676f437be686fc10c68e202e6fce99975340476a44a921
ep_bytes: b8b88749005064ff3500000000648925
timestamp: 2013-09-14 08:01:07

Version Info:
0: [No Data]

Backdoor.Win32.Plite.bhuu also known as:

How to remove Backdoor.Win32.Plite.bhuu?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.