Categories: Backdoor

About “Backdoor:Win32/Ganipin.A” infection

The Backdoor:Win32/Ganipin.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Ganipin.A virus can do?

Sample contains Overlay data
CAPE extracted potentially suspicious content
Drops a binary and executes it
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Creates a copy of itself

How to determine Backdoor:Win32/Ganipin.A?


File Info:
name: 2B06928055DA7E99F988.mlwpath: /opt/CAPEv2/storage/binaries/28072cb4893e530683f6881379a15fd69928c87cb053825884cd0d9a8eb23a34crc32: 6094DC69md5: 2b06928055da7e99f98862d753e0f77fsha1: acffe7a839abb571e91232ee3ff93b852e0640f6sha256: 28072cb4893e530683f6881379a15fd69928c87cb053825884cd0d9a8eb23a34sha512: 8dcf53a76781b91381adb4063235cd0e66e92f9af26001ce9906ccc54d65ff66d3a2964814501b423c41aa84b38a773dbf127dbe5ce6a2401a88e9d885a59f97ssdeep: 768:CpGH/U+JdMk7JwOeUsCPxKXCQv4LdYPokLXKCC6FQxB:CY9vZ7J8CJK0JWok78y4Btype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T164534A017A628577D5458B7050A67B15A7FEBE300A36888FE77C6EEE3F618D06927303sha3_384: 04e8d70c19d5bfcc06b7b2fa45291c1ef9b8a260cedc8cc47c7ad299f7b3458e44daaa54f8dc28eab1d1cbd0563c2ab3ep_bytes: 558bec6aff68d0810014688451001464timestamp: 1987-01-30 03:38:08
Version Info:
0: [No Data]

Backdoor:Win32/Ganipin.A also known as:

Bkav	W32.Paganini.Heur
Lionic	Trojan.Win32.Generic.loni
DrWeb	BackDoor.Agent.41
MicroWorld-eScan	Gen:Trojan.Malware.eqY@aGelo9h
CAT-QuickHeal	Trojan.Malex.F4
ALYac	Gen:Trojan.Malware.eqY@aGelo9h
Malwarebytes	Malware.AI.3386489909
Zillya	Backdoor.Small.Win32.11878
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Backdoor:Win32/Ganipin.e21910e7
K7GW	Trojan ( 0053268b1 )
K7AntiVirus	Trojan ( 0053268b1 )
BitDefenderTheta	AI:Packer.78178D521B
VirIT	Trojan.Win32.Agent2.AXEK
Cyren	W32/Heuristic-114!Eldorado
Symantec	W32.IRCBot
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.PIH
APEX	Malicious
ClamAV	Win.Trojan.Small-14355
Kaspersky	Backdoor.Win32.Small.abv
BitDefender	Gen:Trojan.Malware.eqY@aGelo9h
NANO-Antivirus	Trojan.Win32.Agent.crsnft
Avast	Win32:FakeAlert-ABX [Trj]
Emsisoft	Gen:Trojan.Malware.eqY@aGelo9h (B)
F-Secure	Malware.W32/Virut.Gen
Baidu	Win32.Backdoor.Small.a
VIPRE	Gen:Trojan.Malware.eqY@aGelo9h
TrendMicro	BKDR_GANIPIN.SMI
McAfee-GW-Edition	BehavesLike.Win32.Generic.kt
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.2b06928055da7e99
Sophos	Troj/Spy-GK
SentinelOne	Static AI – Malicious PE
GData	Gen:Trojan.Malware.eqY@aGelo9h
Jiangmin	TrojanSpy.Agent.jsb
Webroot	W32.Backdoor.Gen
Google	Detected
Avira	W32/Virut.Gen
MAX	malware (ai score=80)
Antiy-AVL	Trojan[Backdoor]/Win32.Small
Xcitium	Backdoor.Win32.Small.~GZ@1h5hxj
Arcabit	Trojan.Malware.E5E133
ViRobot	Backdoor.Win32.Small.53248.D
ZoneAlarm	Backdoor.Win32.Small.abv
Microsoft	Backdoor:Win32/Ganipin.A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Inject.C143038
Acronis	suspicious
McAfee	BackDoor-FBQR!2B06928055DA
TACHYON	Trojan/W32.Rootkit.65536.EX
VBA32	BScope.Backdoor.Small
Cylance	unsafe
Panda	Generic Malware
TrendMicro-HouseCall	BKDR_GANIPIN.SMI
Rising	Trojan.Win32.Cosmu.g (CLASSIC)
Yandex	Trojan.GenAsa!nKUumiONXE0
Ikarus	Trojan.Win32.Malex
MaxSecure	Trojan.Malware.2564289.susgen
Fortinet	W32/Ganipin.KID!tr
AVG	Win32:FakeAlert-ABX [Trj]
Cybereason	malicious.055da7
DeepInstinct	MALICIOUS