Backdoor.Win32.TeviRat.iz information

The Backdoor.Win32.TeviRat.iz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.TeviRat.iz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
• Likely virus infection of existing system binary

How to determine Backdoor.Win32.TeviRat.iz?

File Info:
name: 433DAC90CA39024BEB2C.mlw
path: /opt/CAPEv2/storage/binaries/4626bd1f1fb40f90176f895bb8f21427185000f429563b194a5a13bdd9135508
crc32: 5B3086B4
md5: 433dac90ca39024beb2ce8b47b25a9aa
sha1: 4a1e4b3f4e1b495bda5673e766ce6f2585d10930
sha256: 4626bd1f1fb40f90176f895bb8f21427185000f429563b194a5a13bdd9135508
sha512: 4eb93416ff28928d668b84b726a38ccf0ec0aede2412da8e167fa72778f94735b9bd7651d1fc52d75199f2f6f5d84e984a9643567715778caadcf22677de751c
ssdeep: 98304:P1QTfdAyToLCKnE7ffw+uSM0oauED/tq+V8d:NydlIbELw+605u/qe
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CAF5F1377188653EC4AF37314573A41054FBAEA9F4166E1637E0E88DDF324C02E3AA66
sha3_384: 2d78ee7bfd0f030dffd5edc20c001e3bca72f35ea70a99b6c1ab84c776ca740a120b857267fd1615e91b68c444f04d86
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2021-07-22 05:43:38

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: Cat Logic                                                   
FileDescription: CatList Setup                                               
FileVersion:                     
LegalCopyright:                                                                                                     
OriginalFileName:                                                   
ProductName: CatList                                                     
ProductVersion: 0.8a                                              
Translation: 0x0000 0x04b0

Backdoor.Win32.TeviRat.iz also known as:

How to remove Backdoor.Win32.TeviRat.iz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.