Categories: Backdoor

Backdoor:Win32/Botgor.B malicious file

The Backdoor:Win32/Botgor.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Botgor.B virus can do?

CAPE extracted potentially suspicious content
Drops a binary and executes it
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
Creates a copy of itself
Deletes executed files from disk
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Botgor.B?


File Info:
name: 07C946AB934D72182905.mlwpath: /opt/CAPEv2/storage/binaries/fd40e344664bf6bd612d7834a8c7a1c7806e5310e08607be7f824b62b01865e8crc32: 889E4738md5: 07c946ab934d721829059d5b03b49a10sha1: 2e119129d4bdd0beb61ac2ddcc18e3bd20e2e1f0sha256: fd40e344664bf6bd612d7834a8c7a1c7806e5310e08607be7f824b62b01865e8sha512: c427b29c720b6aebfe1104eaad217b26d5553e137f7cea0ceabc2b711754e9794bb863639f23939444075590968af5845cc39c4b7073f2e565ee2fd3fcf5962assdeep: 1536:h+gi2i/OTW1bk3FwErVAHcTMBignpwLsO9NXw6dczv:h6Z1bk1FVAHcTyO4O9fczvtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11BE3E601A4914021EC5310B9DD6E8BF831685DD12F4B29FBC3A6FF7E0B319F2A5B255Asha3_384: 16802a02fe991dde2a42a3377d3726a1153b0f8b8a784e7164483b0a06b307562789cbfc938d34528ece49a41d5ae2c7ep_bytes: 558bec83ec088d45fc506a006a006820timestamp: 2008-08-29 13:01:43
Version Info:
Translation: 0x0000 0x04b0Comments: Spreadsheet Compare UtilityCompanyName: MicrosoftFileDescription: Spreadsheet CompareFileVersion: 5.5.0.5InternalName: SpreadsheetCompare.exeLegalCopyright: Copyright© Microsoft 2008-2011OriginalFilename: SpreadsheetCompare.exeProductName: Enterprise Risk ManagerProductVersion: 5.5.0.5Assembly Version: 5.5.0.5

Backdoor:Win32/Botgor.B also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Backdoor.Agent.A
Skyhigh	BehavesLike.Win32.Dropper.cm
ALYac	Win32.Backdoor.Agent.A
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( f10005021 )
K7GW	Trojan ( f10005021 )
Cybereason	malicious.b934d7
Arcabit	Win32.Backdoor.Agent.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Botgor
APEX	Malicious
McAfee	BackDoor-DSE.b
ClamAV	Win.Malware.Botgor-9853222-0
Kaspersky	Worm.Win32.Burn.b
BitDefender	Win32.Backdoor.Agent.A
NANO-Antivirus	Trojan.Win32.Generic.wdwvx
Avast	Win32:Agent-ADAU [Trj]
Tencent	Worm.Win32.Burn.a
Emsisoft	Win32.Backdoor.Agent.A (B)
Google	Detected
F-Secure	Trojan.TR/Crypt.XPACK.Gen
DrWeb	BackDoor.Siggen.46270
VIPRE	Win32.Backdoor.Agent.A
TrendMicro	BKDR_BOTGOR.SML
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.07c946ab934d7218
Sophos	W32/Burn-Gen
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor/Agent.bfic
Varist	W32/Heuristic-114!Eldorado
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Worm/Win32.Burn
Kingsoft	malware.kb.a.1000
Xcitium	Backdoor.Win32.Agent.~APQ@4ud5h
Microsoft	Backdoor:Win32/Botgor.B
ZoneAlarm	Worm.Win32.Burn.b
GData	Win32.Trojan.Botgor.A
Cynet	Malicious (score: 100)
AhnLab-V3	Worm/Win.Burn.C5606811
BitDefenderTheta	AI:FileInfector.A44F3C4816
MAX	malware (ai score=88)
VBA32	BScope.Backdoor.Botgor
Cylance	unsafe
Panda	W32/BotNet.K
TrendMicro-HouseCall	BKDR_BOTGOR.SML
Rising	Virus.Botgor!1.D115 (CLASSIC)
Yandex	Trojan.GenAsa!D907akwlPeY
Ikarus	BehavesLike.Win32.ProcessHijack
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Botgor.A
AVG	Win32:Agent-ADAU [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)
alibabacloud	Trojan:Win/Botgor.A(dyn)