About “Backdoor:Win32/Hupigon.EA” infection

The Backdoor:Win32/Hupigon.EA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Hupigon.EA virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Attempts to modify proxy settings
• CAPE detected injection into a browser process, likely for Man-In-Browser (MITB) infostealing
• Creates a copy of itself
• Touches a file containing cookies, possibly for information gathering
• Created a service that was not started
• Collects information to fingerprint the system
• Uses suspicious command line tools or Windows utilities

How to determine Backdoor:Win32/Hupigon.EA?

File Info:
name: F401298D083AF149FEDB.mlw
path: /opt/CAPEv2/storage/binaries/df7b7dba8f0a3cf2d3f511de17aebbbeb397d30f6a5d27e9e1f8d77e5ccd86d6
crc32: 0755D2C4
md5: f401298d083af149fedb87dee779f1d7
sha1: 67e10f334f621ffc9bdd20deb7bd36d7d5be30a6
sha256: df7b7dba8f0a3cf2d3f511de17aebbbeb397d30f6a5d27e9e1f8d77e5ccd86d6
sha512: 02a003d57062b6d1c6b24ff075f1325889a3e4d6e854aa0b98c2e8b4d8b55216085531a31e03a65b823dc6bfdba5d4c238518987080fc120aa511b9021833f87
ssdeep: 768:i2PwpmuqnQcXyuR6GHsw0FJFeZuSUxS+zx3yNNd0X8lnQY:iuuqnQcXyyoDFbe/+zxCnda8N
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F3035C96B5A250F2C02CC6FC6C269259BE2E7430ADB846B679EF1DCDCDBD3D2490C116
sha3_384: b78754e692d3b172c750f6145c8b8f0639682cd428fe0d2ea8d334e5d50dd0a2390342710214e876bcca6552cda7968c
ep_bytes: 608bd150535352505151515252535052
timestamp: 2007-07-24 10:00:07

Version Info:
0: [No Data]

Backdoor:Win32/Hupigon.EA also known as:

How to remove Backdoor:Win32/Hupigon.EA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.