Categories: Backdoor

Backdoor.XRat removal instruction

The Backdoor.XRat is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.XRat virus can do?

Unconventionial language used in binary resources: Chinese (Traditional)
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
Collects information about installed applications
Network activity detected but not expressed in API logs
Checks the CPU name from registry, possibly for anti-virtualization
Attempts to access Bitcoin/ALTCoin wallets
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Anomalous binary characteristics

How to determine Backdoor.XRat?


File Info:
crc32: EDC65EBAmd5: f15cc157a4bf9cc35af3868855fec08aname: file2.exesha1: 24b85e7b1c08bb8855bf3fba0f91a8d27ec68b4fsha256: b4663d3db83111238a3045f3e909348efad55f216626eff45587d08ec2820765sha512: f2cee6d0ed2f91a16b09cc695986d9cc74831f479a5b3206a2fac2f5fc32c8332833d701673ae329c510e033914ca13d312ca7246e31f064b8dce463ee7f6bd9ssdeep: 98304:wxBuOYAJsL0wS7tin0S2EhvQxG9oDYy7J7YUATEqWXk:Aut2swHRKh4xG967vXktype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2016 Realtek Semiconductor Corporation. All Right Reserved. InternalName: RTInstallerFileVersion: 1.0.0.46CompanyName: Realtek Semiconductor Corp.ProductName: RTInstallerProductVersion: 1.0.0.46FileDescription: RTInstallerOriginalFilename: RTInstaller.exeTranslation: 0x0409 0x04b0

Backdoor.XRat also known as:

Bkav	HW32.Packed.
DrWeb	Trojan.PWS.Siggen2.45888
FireEye	Generic.mg.f15cc157a4bf9cc3
McAfee	Artemis!F15CC157A4BF
Cylance	Unsafe
Sangfor	Malware
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34104.@J0@aaUh0Pcj
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Spy.Win32.Stealer.sfs
AegisLab	Trojan.Multi.Generic.4!c
McAfee-GW-Edition	BehavesLike.Win32.Dropper.rc
Trapmine	malicious.high.ml.score
Sophos	Mal/VMProtBad-A
Endgame	malicious (high confidence)
ZoneAlarm	Trojan-Spy.Win32.Stealer.sfs
Microsoft	Trojan:Win32/Wacatac.D!ml
Malwarebytes	Backdoor.XRat
ESET-NOD32	Win32/Spy.Agent.PWS
Rising	Malware.Heuristic!ET#92% (RDMK:cmRtazoPnQeZbOaVXgYSUY6YyEOk)
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Malicious_Behavior.VEX
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_90% (W)