Categories: Backdoor

How to remove “Backdoor:Win32/Detarmal!pz”?

The Backdoor:Win32/Detarmal!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Detarmal!pz virus can do?

Sample contains Overlay data
CAPE extracted potentially suspicious content
Drops a binary and executes it
Authenticode signature is invalid
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process

How to determine Backdoor:Win32/Detarmal!pz?


File Info:
name: 3FD60DB6E4469FE95103.mlwpath: /opt/CAPEv2/storage/binaries/f657b1664031fcc2fe13fd4f4a87510ad03eafeadf1bd9674fa1dd98fea5141fcrc32: C83EA632md5: 3fd60db6e4469fe95103afbb5438e466sha1: ea6f61a534fe3cec5569d19fb944acb7bc8d7dd5sha256: f657b1664031fcc2fe13fd4f4a87510ad03eafeadf1bd9674fa1dd98fea5141fsha512: 34bd2f522a365cb647e640c0c3c530f2ecd0c70baee7742f610c239cc23c4d2adbc3933ea3c19fdee0c097a36d35f073e2348f3d6fd1c63cff198e308135fc8fssdeep: 768:mlowCSZNNlBT+2ewLIXetoJXctYmuFMeNz58RnrldAmOz2BdZ2ZimbdjKK:mlHBTxewtoJXctuJNz5GA2Z2ZZ2Ktype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AA438E4360D25833FC1845B011A73F72DB7EAE940A7178871BA0EEA56D2B9BF9738147sha3_384: ed5ab17041db34a4ea91f7a6109482346611380cd05ce61fd3c861ba9e056fb5fbf10d9f868ca73d49ceb5bc04ececfaep_bytes: 6aff6840b340006838a9400064a10000timestamp: 2005-08-25 20:35:05
Version Info:
0: [No Data]

Backdoor:Win32/Detarmal!pz also known as:

Lionic	Trojan.Win32.Detarmal.m!c
DrWeb	BackDoor.Cae.7
MicroWorld-eScan	Gen:Variant.Lazy.209488
FireEye	Generic.mg.3fd60db6e4469fe9
CAT-QuickHeal	Backdoor.Agent.20117
Skyhigh	BehavesLike.Win32.Ransomware.qh
McAfee	GenericRXFV-ZA!3FD60DB6E446
Cylance	unsafe
VIPRE	Gen:Variant.Lazy.209488
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004ca33e1 )
Alibaba	Backdoor:Win32/Detarmal.7b7d6522
K7GW	Trojan ( 004ca33e1 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	AI:Packer.FAFB4B121F
VirIT	Trojan.Win32.Agent.AKNV
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Detarmal.A
APEX	Malicious
TrendMicro-HouseCall	BKDR_DETARMAL.SM
Avast	Win32:Agent-XO [Trj]
ClamAV	Win.Trojan.Agent-31396
Kaspersky	Backdoor.Win32.Poison.gjxk
BitDefender	Gen:Variant.Lazy.209488
NANO-Antivirus	Trojan.Win32.Agent.rhabk
Rising	Backdoor.Win32.Undef.gxb (CLASSIC)
Sophos	Mal/Behav-027
F-Secure	Backdoor.BDS/Agent.WH
Baidu	Win32.Backdoor.Detarmal.b
Zillya	Backdoor.Agent.Win32.43755
TrendMicro	BKDR_DETARMAL.SM
Trapmine	suspicious.low.ml.score
Emsisoft	Gen:Variant.Lazy.209488 (B)
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=100)
GData	Gen:Variant.Lazy.209488
Jiangmin	Trojan/Generic.buvz
Webroot	Backdoor.Trojan
Google	Detected
Avira	BDS/Agent.WH
Varist	W32/Bloop.A.gen!Eldorado
Antiy-AVL	Trojan[Backdoor]/Win32.Detarmal
Kingsoft	malware.kb.a.1000
Xcitium	Backdoor.Win32.Stupa.uy@396in9
Arcabit	Trojan.Lazy.D33250
ViRobot	Trojan.Win.Z.Detarmal.57152.AI
ZoneAlarm	Backdoor.Win32.Poison.gjxk
Microsoft	Backdoor:Win32/Detarmal!pz
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R5613
VBA32	Backdoor.Detarmal
ALYac	Gen:Variant.Lazy.209488
TACHYON	Trojan/W32.Agent.57152.C
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Downloader.XXY
Tencent	Backdoor.Win32.Agent.bi
Yandex	Trojan.GenAsa!xFiEo4TgITs
Ikarus	Trojan-Dropper.Agent
MaxSecure	Trojan.Malware.2361991.susgen
Fortinet	W32/Agent.BIR!tr.bdr
AVG	Win32:Agent-XO [Trj]
Cybereason	malicious.6e4469
DeepInstinct	MALICIOUS
alibabacloud	Backdoor:Win/Detarmal.A