Categories: Backdoor

Backdoor:Win32/Coroxy.A malicious file

The Backdoor:Win32/Coroxy.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Coroxy.A virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Enumerates running processes
Authenticode signature is invalid
Attempts to modify desktop wallpaper
Installs itself for autorun at Windows startup
Creates a hidden or system file
CAPE detected the MiniTor malware family
Creates a copy of itself

How to determine Backdoor:Win32/Coroxy.A?


File Info:
name: 77655E2B7AD71B6B79AB.mlwpath: /opt/CAPEv2/storage/binaries/b13558ee35b1303dc8a24fc8e417fc95d71c2c7f6f4894597ec7a82e4a730e00crc32: 692660CFmd5: 77655e2b7ad71b6b79abd742ffdb727csha1: cfa90262058c16b7fb097dca9b5eff3d76f94480sha256: b13558ee35b1303dc8a24fc8e417fc95d71c2c7f6f4894597ec7a82e4a730e00sha512: b48d5ad74825e23143f9905297291a2d36b4f6196270ba9eabbf83c2f0ff85536b14fee6af361a1136d0e6afbedae26ee25859178ef6e5591a354d9cedcea9b1ssdeep: 768:4TwkPr8C6fuFdaAna6DCPt34GuYY92rjnPoJlYcaFI1:MV8C6fuFdaz6+O1n2rjnPo7type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1EEE2E7263450A6B1D4918AF03A5EA794C9BE78378266E48DFFE09F1436B1DD7E706203sha3_384: eefc06bf61caf8d13c52bcae45a131a286b63aded3143f8231669b78c910f7c4db9f074695e8d52c7da5681850fbedc6ep_bytes: 558bec81c4f0fbffff8d4d002bcc518dtimestamp: 2020-08-11 03:49:48
Version Info:
0: [No Data]

Backdoor:Win32/Coroxy.A also known as:

Bkav	W32.AIDetect.malware2
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
FireEye	Generic.mg.77655e2b7ad71b6b
McAfee	GenericRXMG-BK!77655E2B7AD7
Cylance	Unsafe
Zillya	Trojan.Coroxy.Win32.42
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005690c81 )
K7GW	Trojan ( 005690c81 )
Cybereason	malicious.b7ad71
VirIT	Trojan.Win32.Spynet.BT
Cyren	W32/Occamy.AD.gen!Eldorado
Symantec	Backdoor.SystemBC
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Coroxy.C
APEX	Malicious
Kaspersky	HEUR:Trojan-Proxy.Win32.Sybici.vho
BitDefender	Dropped:Generic.Malware.F!dld!.8A56E4EB
NANO-Antivirus	Trojan.Win32.Sybici.hsjdkb
MicroWorld-eScan	Dropped:Generic.Malware.F!dld!.8A56E4EB
Avast	Win32:CrypterX-gen [Trj]
Ad-Aware	Dropped:Generic.Malware.F!dld!.8A56E4EB
Sophos	ML/PE-A + Troj/Coroxy-A
DrWeb	Trojan.Spynet.45
VIPRE	Dropped:Generic.Malware.F!dld!.8A56E4EB
TrendMicro	Trojan.Win32.COROXY.SMYXBC3A
McAfee-GW-Edition	BehavesLike.Win32.Generic.nm
Trapmine	malicious.high.ml.score
Emsisoft	Dropped:Generic.Malware.F!dld!.8A56E4EB (B)
Ikarus	Trojan-Spy.Win32.Zbot
GData	Dropped:Generic.Malware.F!dld!.8A56E4EB
Avira	TR/Crypt.XPACK.Gen2
Antiy-AVL	Trojan/Generic.ASMalwS.6F88
Arcabit	Generic.Malware.F!dld!.8A56E4EB
Microsoft	Backdoor:Win32/Coroxy.A
AhnLab-V3	Trojan/Win32.Agent.R299398
Acronis	suspicious
VBA32	BScope.TrojanProxy.Sybici
ALYac	Dropped:Generic.Malware.F!dld!.8A56E4EB
MAX	malware (ai score=83)
Malwarebytes	Trojan.Coroxy
TrendMicro-HouseCall	Trojan.Win32.COROXY.SMYXBC3A
Rising	Trojan.Generic@AI.100 (RDML:27JzOLTaorlSXLlUl48VNw)
Yandex	Trojan.Coroxy!FKQSDvf86Uc
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.104545701.susgen
Fortinet	W32/Coroxy.A!tr
BitDefenderTheta	Gen:NN.ZexaF.34806.bqW@ayuS6ak
AVG	Win32:CrypterX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_70% (D)