Categories: Backdoor

Backdoor:Win32/Death.A removal

The Backdoor:Win32/Death.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Death.A virus can do?

Executable code extraction
Creates RWX memory
Starts servers listening on 0.0.0.0:30003
Expresses interest in specific running processes
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Creates an autorun.inf file
Installs itself for autorun at Windows startup
Harvests credentials from local FTP client softwares
Anomalous binary characteristics

How to determine Backdoor:Win32/Death.A?


File Info:
crc32: EB186AC0md5: b26b192cc561fe0771cc6f2b8a80c91ename: B26B192CC561FE0771CC6F2B8A80C91E.mlwsha1: 62582526ba8c652085613fdb04534a6d87bb5325sha256: bd445b8ceae1b7e0d0218f882a2ae567a0689224a531f24aeb1edf3f28c57476sha512: 6178c100d77134b022af192084b462b10d303e449839a7eb704ccc8261b35df896781b791e798da41a517806f194b8d77153eed02aa9428da249aa8053d60b3assdeep: 6144:qNa0UZ7RSZP7xxtV1Z0FaVLnh6Hd1wHxCQgX3ocngZfjeNn2vE3nycFn:muwPV51Z0FaVDh0wRt43DgZaN2vMtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
0: [No Data]

Backdoor:Win32/Death.A also known as:

Elastic	malicious (high confidence)
DrWeb	BackDoor.Death.27
ClamAV	Win.Trojan.Death-7
McAfee	BackDoor-FP.cfg
Cylance	Unsafe
Zillya	Backdoor.Death.Win32.72
Sangfor	Trojan.Win32.Save.a
K7GW	Trojan ( 7000000f1 )
K7AntiVirus	Trojan ( 7000000f1 )
Cyren	W32/Death.TLKD-2428
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Death.27.A
APEX	Malicious
Avast	Win32:Trojan-gen
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Death.27.a
BitDefender	Backdoor.Death.2.7.A
NANO-Antivirus	Trojan.Win32.Death.ffbd
ViRobot	Backdoor.Win32.Death.22528
MicroWorld-eScan	Backdoor.Death.2.7.A
Ad-Aware	Backdoor.Death.2.7.A
Sophos	Mal/Generic-R + Troj/Death-27
Comodo	Backdoor.Win32.Death.27.A@1wd3
BitDefenderTheta	AI:Packer.75453EFC1D
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	BKDR_DEATH.A
McAfee-GW-Edition	BehavesLike.Win32.BadFile.fc
FireEye	Generic.mg.b26b192cc561fe07
Emsisoft	Backdoor.Death.2.7.A (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Backdoor/Death.27.a
Avira	TR/Dldr.Delphi.Gen
eGambit	Unsafe.AI_Score_100%
Antiy-AVL	Trojan/Generic.ASMalwS.34073
Microsoft	Backdoor:Win32/Death.A
ZoneAlarm	Backdoor.Win32.Death.27.a
GData	Backdoor.Death.2.7.A
VBA32	Backdoor.Death
MAX	malware (ai score=86)
Panda	Bck/Iroffer.BG
TrendMicro-HouseCall	BKDR_DEATH.A
Tencent	Win32.Backdoor.Death.Pdlz
Yandex	Trojan.GenAsa!4JL5gw6BbGk
Ikarus	Backdoor.Win32.Death
Fortinet	W32/Death_27.A!tr.bdr
AVG	Win32:Trojan-gen
Paloalto	generic.ml
Qihoo-360	Win32/Backdoor.Generic.HwsBEpsA