Categories: Backdoor

Backdoor:Win32/Delf.DB information

The Backdoor:Win32/Delf.DB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Delf.DB virus can do?

Scheduled file move on reboot detected
Creates RWX memory
Dynamic (imported) function loading detected
Starts servers listening on 0.0.0.0:13401, 0.0.0.0:6677
Reads data out of its own binary image
Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Creates a copy of itself

How to determine Backdoor:Win32/Delf.DB?


File Info:
name: 5CFC6BA90098CF26DC15.mlwpath: /opt/CAPEv2/storage/binaries/af225c3e8f90e3d24600a523d236f85e8cf774877a822e7655d97b14b81d7b82crc32: 6CF86060md5: 5cfc6ba90098cf26dc15f51c67164e6bsha1: c6be82eb1895452e2095cf1eaaa057bf1330c7ccsha256: af225c3e8f90e3d24600a523d236f85e8cf774877a822e7655d97b14b81d7b82sha512: 4cb8a75db1478c4a12264c4529975207f7659c3827e0fb27aefd5ddaf8dafd21167a095d59903e85f6044cedf97df87ba3f93fcfc0fdb78d4b8b850781511d06ssdeep: 24576:KsAZNKdA8xcTPN/5+qSbgl6KIyCLdufaK:KsAZ2QYZtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1BCF47C22F6514837C16316789C9B57B99C3ABF112F28A94767F92D1C0E7A6C03D392F2sha3_384: a0bfd13fa3c6da04277c634e413597a0b5cfcdda32546b9dc784d47b160dd8d36950af1e8b41faded9297d53b82082f2ep_bytes: 558bec83c4f4b858a84900e818c0f6fftimestamp: 1992-06-19 22:22:17
Version Info:
CompanyName: MicrosoftFileDescription: Exception manager for Win32FileVersion: 1.0.0.0InternalName: WinallapLegalCopyright: MSLegalTrademarks: MS Windows 9*OriginalFilename: winallapProductName: Exception manager for Win32ProductVersion: 1.0.0.0Comments: Recomended to run on Pentium II SystemSpecialBuild: YesTranslation: 0x0419 0x04e3

Backdoor:Win32/Delf.DB also known as:

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	BackDoor.Winalap
MicroWorld-eScan	Gen:Trojan.Backdoor2.WG0@aqjpxKbc
FireEye	Gen:Trojan.Backdoor2.WG0@aqjpxKbc
McAfee	Generic BackDoor.d
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Generic.ky
K7AntiVirus	Trojan ( 7000000f1 )
Alibaba	Backdoor:Win32/Generic.30ce43b9
K7GW	Trojan ( 7000000f1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	AI:Packer.4F1B77381C
Cyren	W32/Backdoor.NZTJ-4397
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Delf.DB
TrendMicro-HouseCall	BKDR_DELF.DB
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Trojan.Backdoor2.WG0@aqjpxKbc
NANO-Antivirus	Trojan.Win32.Delf.fffg
Avast	Win32:Trojan-gen
Tencent	Trojan.Win32.BitCoinMiner.la
Ad-Aware	Gen:Trojan.Backdoor2.WG0@aqjpxKbc
Sophos	Mal/Generic-R + Troj/Delf-DB
Comodo	Backdoor.Win32.Delf.DB@tb6
Zillya	Backdoor.Delf.Win32.2208
TrendMicro	BKDR_DELF.DB
McAfee-GW-Edition	BehavesLike.Win32.AdwareIMonster.bh
CMC	Generic.Win32.5cfc6ba900!MD
Emsisoft	Gen:Trojan.Backdoor2.WG0@aqjpxKbc (B)
GData	Gen:Trojan.Backdoor2.WG0@aqjpxKbc
Jiangmin	Backdoor/Winallap
eGambit	Generic.Backdoor
Avira	BDS/Backdoor.Gen2
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.1B6336
Kingsoft	Win32.Hack.Delf.db.(kcloud)
Arcabit	Trojan.Backdoor2.EB5DD6
ViRobot	Backdoor.Win32.Delf.789504
Microsoft	Backdoor:Win32/Delf.DB
Cynet	Malicious (score: 99)
VBA32	Backdoor.Delf
ALYac	Gen:Trojan.Backdoor2.WG0@aqjpxKbc
APEX	Malicious
Rising	Trojan.Delf.db (CLASSIC)
Yandex	Backdoor.Delf!6Z7RQMiZJ6E
Ikarus	Trojan.Win32.Delf
MaxSecure	Trojan.Malware.1839308.susgen
Fortinet	W32/Delf.DB!tr.bdr
Webroot	W32.Trojan.Trojan-Backdoor.Gen.
AVG	Win32:Trojan-gen
Cybereason	malicious.90098c
Panda	Bck/Delf.db