Categories: Backdoor

What is “Backdoor:MSIL/Bladabindi.ABH!MTB”?

The Backdoor:MSIL/Bladabindi.ABH!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:MSIL/Bladabindi.ABH!MTB virus can do?

Presents an Authenticode digital signature
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics
CAPE detected the RedLine malware family
Binary compilation timestomping detected

How to determine Backdoor:MSIL/Bladabindi.ABH!MTB?


File Info:
name: 3E4581EF3EDDE37E45DF.mlwpath: /opt/CAPEv2/storage/binaries/d1f0c78c2554d93e4fbfb5e8808f54ff6979647acd31987a742d961acf628aabcrc32: 121908ECmd5: 3e4581ef3edde37e45df07613a417b56sha1: c66937e01b874ef70e638b96544e77bd88288b4bsha256: d1f0c78c2554d93e4fbfb5e8808f54ff6979647acd31987a742d961acf628aabsha512: 8eff1097d6a6c656d8faede6247644fad987417ce4428e19ee4bbfc2f125afadb3c29e239d3e6aa865cdacebb12941b6f34ecee902b367b63cbbf0e49f94e6f1ssdeep: 3072:Mwh5n6/Lji2LejHGyu3lINM5OucR2UJhHA+hW+NUsd:MGM/HbajmyurX+hFNtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T171145C41279E9E14E6BE5A70D1F2046047F5E683BA23D78E3CC425E50E52701FE1ABEEsha3_384: adb6f3f40a387539932d80ca310488a0e1d7b2b4ce15304d4132d9bdc62ce3ced788f20db848b8654f487fa357d67be5ep_bytes: ff250020400000000000000000000000timestamp: 2091-07-23 20:03:52
Version Info:
Translation: 0x0000 0x04b0FileDescription:  FileVersion: 0.0.0.0InternalName: Periclines.exeLegalCopyright:  OriginalFilename: Periclines.exeProductVersion: 0.0.0.0Assembly Version: 0.0.0.0

Backdoor:MSIL/Bladabindi.ABH!MTB also known as:

Bkav	W32.AIDetectNet.01
Lionic	Virus.Win32.Parite.lVuJ
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.32664
MicroWorld-eScan	Trojan.GenericKD.49122413
FireEye	Generic.mg.3e4581ef3edde37e
ALYac	Trojan.GenericKD.49122413
Cylance	Unsafe
VIPRE	Trojan.GenericKD.49122413
K7AntiVirus	Spyware ( 0057a2c81 )
K7GW	Spyware ( 0057a2c81 )
Cybereason	malicious.01b874
Cyren	W32/MSIL_Agent.CIU.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/Spy.Agent.DFY
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXCDZZ
ClamAV	Win.Trojan.Redline-9938775-1
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.49122413
NANO-Antivirus	Trojan.Win32.Stealer.jpgknb
Avast	Win32:PWSX-gen [Trj]
Rising	Stealer.Agent!1.DC63 (CLASSIC)
Ad-Aware	Trojan.GenericKD.49122413
Zillya	Trojan.Agent.Win32.2755937
TrendMicro	TrojanSpy.Win32.REDLINE.YXCDZZ
McAfee-GW-Edition	RDN/Generic PWS.y
SentinelOne	Static AI – Malicious PE
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.49122413 (B)
Ikarus	Trojan.MSIL.Spy
Jiangmin	Trojan.PSW.MSIL.dpra
Webroot	W32.Trojan.MSIL.Stealer
Avira	HEUR/AGEN.1235899
Kingsoft	Win32.PSWTroj.Undef.(kcloud)
Microsoft	Backdoor:MSIL/Bladabindi.ABH!MTB
Arcabit	Trojan.Generic.D2ED8C6D
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Reline.gen
GData	MSIL.Trojan.PSE1.10VQHQI
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win32.RL_Generic.C4036845
Acronis	suspicious
McAfee	RDN/Generic PWS.y
VBA32	Trojan-Stealer.MSIL.gen
Malwarebytes	Spyware.DiscordStealer
Tencent	Malware.Win32.Gencirc.11ef8fd1
MAX	malware (ai score=87)
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Agent.DFY!tr.spy
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (W)