Categories: Backdoor

What is “Backdoor:Win32/Bedep!rfn”?

The Backdoor:Win32/Bedep!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Bedep!rfn virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Bedep!rfn?


File Info:
name: 6FFEBC0D33231051182C.mlwpath: /opt/CAPEv2/storage/binaries/fc861c0f59db085400d4337f5b20b36c6f88a28c3703a1caeb319d34cb4d75dacrc32: 862F6D2Emd5: 6ffebc0d33231051182c95b27e9eb9e4sha1: 6357116ee744b08561d5162f6a255a33b1a481basha256: fc861c0f59db085400d4337f5b20b36c6f88a28c3703a1caeb319d34cb4d75dasha512: 3bec0b6e8d5f678492a5d3696c08e747a942ebadc5e6c48b9df48cd4fcf5ea8ae14668f6be9322ee45eb107cbf083dfc5fa961d404e865080735a9e9999cb313ssdeep: 6144:9K6TGzkUdWU0YVBZ0+iCxxS5NRlKda+OtdGC3trJiSGF3:HTtT8r0bfCs+OrGC3znGBtype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windowstlsh: T18D64355AAE46C97DC0F9963EC4C613B976207408C9C15FDAF35BAA0908716E82D73B4Fsha3_384: 6107fc33f5cd325e8f7fe83d1f886e2c131186a6f0dd0622520ebe902355744afcd03c73597f52b9e35ffed77cce19bfep_bytes: e88df9ffffe95f040000e85328000077timestamp: 1970-01-01 00:00:00
Version Info:
CompanyName: Microsoft CorporationFileDescription: Microsoft Jet Expression ServiceFileVersion: 4.00.9756.0InternalName: MSJTES40LegalCopyright: Copyright (C) Microsoft Corp. 1997-1999OriginalFilename: MSJTES40.DLLProductName: Microsoft (R) JetProductVersion: 4.00.9756.0Translation: 0x0000 0x04b0

Backdoor:Win32/Bedep!rfn also known as:

Lionic	Trojan.Win32.Bedep.mE1F
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Packed.fc
McAfee	BackDoor-FCZO!6FFEBC0D3323
Cylance	unsafe
Sangfor	Trojan.Win32.Kryptik.Vjhh
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Backdoor:Win32/Kryptik.cd2fce68
K7GW	Trojan ( 0055dd191 )
K7AntiVirus	Trojan ( 0055dd191 )
Arcabit	Trojan.Mikey.D1B9A6
BitDefenderTheta	AI:Packer.40EA9D7D26
VirIT	Trojan.Win32.Atros2.BDUU
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.EETT
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Mikey.113062
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
MicroWorld-eScan	Gen:Variant.Mikey.113062
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.114db02e
Emsisoft	Gen:Variant.Mikey.113062 (B)
Baidu	Win32.Trojan.Kryptik.rz
F-Secure	Heuristic.HEUR/AGEN.1372711
DrWeb	Trojan.Bedep.62
VIPRE	Gen:Variant.Mikey.113062
FireEye	Generic.mg.6ffebc0d33231051
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1372711
Antiy-AVL	Trojan[Backdoor]/Win32.Bedep
Xcitium	Malware@#176ffdrbu4xca
Microsoft	Backdoor:Win32/Bedep!rfn
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Mikey.113062
VBA32	Backdoor.Bedep
ALYac	Gen:Variant.Mikey.113062
MAX	malware (ai score=89)
Panda	Generic Suspicious
Rising	Malware.Undefined!8.C (TFE:4:YHif3dJx0SB)
Yandex	Trojan.GenAsa!Y2DoEII7d1c
Ikarus	Win32.Outbreak
Fortinet	W32/Kryptik.EFEC!tr
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
alibabacloud	Backdoor:Win/Bedep