Categories: Backdoor

How to remove “Backdoor:Win32/G_Door.Q”?

The Backdoor:Win32/G_Door.Q is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/G_Door.Q virus can do?

Sample contains Overlay data
Uses Windows utilities for basic functionality
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Creates a copy of itself
Deletes executed files from disk
Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/G_Door.Q?


File Info:
name: E727D5E9F3F3D4839306.mlwpath: /opt/CAPEv2/storage/binaries/f847341d67076fdcec843f50decc07f3338972d648dbac5dfd4d5285598603f8crc32: 7515C052md5: e727d5e9f3f3d4839306de978cb559b1sha1: 58e59c77d46c565789e3d843bd1b85b000da22e2sha256: f847341d67076fdcec843f50decc07f3338972d648dbac5dfd4d5285598603f8sha512: 3111baa08e51d2125bdc1b2d3772aefb7912c5f85e3b967dd261e9479821be56716a406faf7e6e5c15a6966227d7a7b05aec1805574305407ffeadd7928b414cssdeep: 12288:CPgnABU8b0NW5ABDOX+h+KnUuY87vGK6LERvQYw5fc2R5XgHC:A7n0NW5ABwPKUw7vF6LERgR5XXtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T119E46D55F2828433E5732B3D8C1B6A9859297F50376CA84B3AF81E4C9F357853A263D3sha3_384: 745582ef303d3e0fcd4a9222b44f2bad8791548bfc22889c42da8202e249d041ea12ee1d46a69c813f06151f97a943b4ep_bytes: 558becb90a0000006a006a004975f951timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Backdoor:Win32/G_Door.Q also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Hupigon.lfX8
Elastic	malicious (high confidence)
DrWeb	BackDoor.IRC.Sdbot.1881
MicroWorld-eScan	Dropped:Generic.Malware.SFBEnk!dld!yg.8BCAA1E6
CMC	Generic.Win32.e727d5e9f3!MD
Skyhigh	BehavesLike.Win32.PWSLegMir.jh
McAfee	BackDoor-AWQ.b
Malwarebytes	Gdoor.Backdoor.Dropper.DDS
Zillya	Backdoor.GDoor.Win32.139
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 7000000f1 )
Alibaba	Backdoor:Win32/G_Door.0292e18b
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.9f3f3d
BitDefenderTheta	Gen:NN.ZelphiF.36802.RGX@aK0xvfob
Symantec	Backdoor.Graybird!Gen
ESET-NOD32	a variant of Win32/Hupigon
APEX	Malicious
TrendMicro-HouseCall	BKDR_HUPIGON.UH
ClamAV	Win.Trojan.Graybird-2
Kaspersky	Backdoor.Win32.G_Door.v
BitDefender	Dropped:Generic.Malware.SFBEnk!dld!yg.8BCAA1E6
NANO-Antivirus	Trojan.Win32.Sdbot.flxcfc
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.13b145d9
Emsisoft	Dropped:Generic.Malware.SFBEnk!dld!yg.8BCAA1E6 (B)
Google	Detected
F-Secure	Trojan.TR/Spy.Gen
Baidu	Win32.Trojan.Hupigon.b
VIPRE	Dropped:Generic.Malware.SFBEnk!dld!yg.8BCAA1E6
TrendMicro	BKDR_HUPIGON.UH
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.e727d5e9f3f3d483
Sophos	Mal/Behav-415
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor/Huigezi.2004.cb
Varist	W32/Hupigon.L.gen!Eldorado
Avira	TR/Spy.Gen
Antiy-AVL	Trojan[Dropper]/Win32.Delf
Kingsoft	Win32.HeurC.KVM005.a
Microsoft	Backdoor:Win32/G_Door.Q
Xcitium	TrojWare.Win32.Trojan.Agent.Gen@2kmjk
Arcabit	Generic.Malware.SFBEnk!dld!yg.8BCAA1E6
ViRobot	Backdoor.Win32.G_Door.60096
ZoneAlarm	Backdoor.Win32.G_Door.v
GData	Dropped:Generic.Malware.SFBEnk!dld!yg.8BCAA1E6
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Hupigon.Gen
Acronis	suspicious
VBA32	Backdoor.G_Door
ALYac	Dropped:Generic.Malware.SFBEnk!dld!yg.8BCAA1E6
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Bck/Graybird.gen
Rising	Backdoor.Hupigon!1.6634 (CLASSIC)
Yandex	Trojan.GenAsa!C06ux+5kCV8
Ikarus	Backdoor.Win32.Hupigon
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Hupigon.OSE!tr.bdr
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)
alibabacloud	Trojan[downloader]:Win/Hupigon.P