Backdoor

Backdoor:MSIL/XHVNC.A!MTB (file analysis)

Malware Removal

The Backdoor:MSIL/XHVNC.A!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Backdoor:MSIL/XHVNC.A!MTB virus can do?

  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Backdoor:MSIL/XHVNC.A!MTB?



File Info:

name: 0D32F2959F3ADF3C6FBF.mlw
path: /opt/CAPEv2/storage/binaries/217fef2f1ea064e5f0ec856e4aaf7fac614d1b00b05a0ee2d25480bfb79c8195
crc32: 32B8A66B
md5: 0d32f2959f3adf3c6fbf585ae6ab1ecf
sha1: 2cc7be5332f36b198e0d5fb0ae74f1cb211b691d
sha256: 217fef2f1ea064e5f0ec856e4aaf7fac614d1b00b05a0ee2d25480bfb79c8195
sha512: 58f6720efb65cf1b61318d753598e30e99aefe76ee0caf07d72dea94f05a1e891d6fcf8f7cd17599de8504cbe6185daa04e296505c84b33aea7437921b6387c9
ssdeep: 1536:aaRmGCCb59dI9Jm82bB65VA85FG/Gd9WO:bRlCCVM2gA/G+O
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AB53D05917C8C638C8FE4DF56C73121187B3D6524823DF9A65C8CA6F6C833998AE2722
sha3_384: fb7e42a7ed1affd8df6a6d613ef9c22757dcc4f6ef49c8b3858fba07b83ff7e4903e189e1b64f5903f56480e0bc68cdb
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-01-19 23:24:40


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: PHVNC
FileVersion: 1.0.0.0
InternalName: PHVNC.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: PHVNC.exe
ProductName: PHVNC
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Backdoor:MSIL/XHVNC.A!MTB also known as:

BkavW32.SpakeTisaAK.Trojan
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Heur.MSIL.Krypt.6
FireEyeGeneric.mg.0d32f2959f3adf3c
McAfeeGenericRXUI-WX!0D32F2959F3A
MalwarebytesGeneric.Malware.AI.DDS
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 004cf1da1 )
K7GWTrojan ( 004cf1da1 )
Cybereasonmalicious.59f3ad
BitDefenderThetaGen:NN.ZemsilF.36318.dm0@amql3xo
CyrenW32/MSIL_Troj.C.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Injector.LOS
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Heur.MSIL.Krypt.6
AvastWin32:InjectorX-gen [Trj]
RisingBackdoor.ArrowRAT!1.E4FF (CLASSIC)
EmsisoftGen:Heur.MSIL.Krypt.6 (B)
F-SecureHeuristic.HEUR/AGEN.1311157
DrWebTrojan.InjectNET.17
VIPREGen:Heur.MSIL.Krypt.6
McAfee-GW-EditionBehavesLike.Win32.Generic.kc
SentinelOneStatic AI – Malicious PE
GDataGen:Heur.MSIL.Krypt.6
JiangminTrojan.Generic.hhajs
AviraHEUR/AGEN.1311157
MAXmalware (ai score=81)
Antiy-AVLTrojan/MSIL.Injector
ArcabitTrojan.MSIL.Krypt.6
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftBackdoor:MSIL/XHVNC.A!MTB
GoogleDetected
AhnLab-V3Win-Trojan/MSILKrypt14.Exp
Acronissuspicious
VBA32Trojan.MSIL.DiscoStealer.Heur
ALYacGen:Heur.MSIL.Krypt.6
Cylanceunsafe
PandaTrj/GdSda.A
TencentMalware.Win32.Gencirc.10bea22f
YandexTrojan.Agent!ctHOwb33m7c
IkarusTrojan-Spy.Keylogger.Snake
MaxSecureTrojan.Malware.7164915.susgen
FortinetMSIL/Injector.B!tr
AVGWin32:InjectorX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Backdoor:MSIL/XHVNC.A!MTB?

Backdoor:MSIL/XHVNC.A!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment