Backdoor.Win32.TeviRat.ka removal guide

The Backdoor.Win32.TeviRat.ka is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.TeviRat.ka virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
• Network activity detected but not expressed in API logs
• Likely virus infection of existing system binary

How to determine Backdoor.Win32.TeviRat.ka?

File Info:
name: 2F071A713A9962EB7340.mlw
path: /opt/CAPEv2/storage/binaries/4415760d9086833c132aff808d53a71f09846526794bce75c6cf1351f6047ea3
crc32: 7E753B5B
md5: 2f071a713a9962eb7340be9fd49c1cd3
sha1: 66a66f8face9b9b9c15597a4f7312a8ae0cb9c0a
sha256: 4415760d9086833c132aff808d53a71f09846526794bce75c6cf1351f6047ea3
sha512: 1933d131dc2df309183c5d111499f1b83ab61e457aafe212dff27e62028ca82f52bab42616a67f998d17d0b55a3cd6dbb064573da9b60a73b86c0fb8235daf5a
ssdeep: 49152:DcsQ6QcTod2zVoUh+w5w7EMdhoxG8YM5NItUwGrK2rr0blD83mk6:D1QTGYgFh+wS7zdhoDX5utEKHHk6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BAE5F127B299B53EC49A2B354573A11058FBB66DF427BE1636F0C48CCF660C11E3EA25
sha3_384: 0b4f27607018f9e008e719c920427a219e27d22596f82ec073da7e4f5bd987936b207fe1c545142e8048e31e8bcea07d
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2021-07-22 05:43:38

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: Cot Logic                                                   
FileDescription: CotList Setup                                               
FileVersion:                     
LegalCopyright:                                                                                                     
OriginalFileName:                                                   
ProductName: CotList                                                     
ProductVersion: 0.8.0.7                                           
Translation: 0x0000 0x04b0

Backdoor.Win32.TeviRat.ka also known as:

How to remove Backdoor.Win32.TeviRat.ka?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.