Backdoor

About “Backdoor:Win32/IRCbot!pz” infection

Malware Removal

The Backdoor:Win32/IRCbot!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor:Win32/IRCbot!pz virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid

How to determine Backdoor:Win32/IRCbot!pz?


File Info:

name: 2BF07C4A23000D7E84CC.mlw
path: /opt/CAPEv2/storage/binaries/f9a0ba35250167a2a0fcd93df38db5163f6228c48c05e78c39653fbcde450b63
crc32: ACBD5C49
md5: 2bf07c4a23000d7e84ccfde8193a01f9
sha1: 80b2978161012baf5ad3e9c3e51541cd1fa51618
sha256: f9a0ba35250167a2a0fcd93df38db5163f6228c48c05e78c39653fbcde450b63
sha512: fa4ceb21133df6a5c311c6b963bdd163d41a5de10e3e3d616695aa44df49ca5e78fb0f5911c06d29540aaca764b037a1034d2185cff680f1f902f8aac1239ef2
ssdeep: 3072:kjLI8wo6CymRGoZd9zCUeDa7c1CovKWQXZ1IFs/rxzJLkHKFbpv5ukN:8LILL6Zdua7rjIiSqNpvF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T129D34C33F1808973D1732E3D9C1A929D6939BD117FB5149A7BE90A5C8E79281A93C3C3
sha3_384: cd10fdb220de3eac3e4775a44e371e1b6158f3c2a0bbb7ebb69b1fe82fc2a8feb43fc7ddce4c57068d5b9513c499f5bc
ep_bytes: 558bec83c4f05356b89cbf0200e8ea9e
timestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Backdoor:Win32/IRCbot!pz also known as:

BkavW32.AIDetectMalware
LionicWorm.Win32.Bybz.l6xL
Elasticmalicious (high confidence)
DrWebTrojan.DownLoader5.23503
MicroWorld-eScanGen:Variant.Jacard.163999
FireEyeGeneric.mg.2bf07c4a23000d7e
CAT-QuickHealBackdoor.IRCbot.K3
SkyhighBehavesLike.Win32.ObfuscatedPoly.ch
McAfeeGenericRXSP-OA!2BF07C4A2300
Cylanceunsafe
ZillyaWorm.AutoRun.Win32.4973
SangforTrojan.Win32.Save.a
AlibabaWorm:Win32/AutoRun.657b0a4c
K7GWTrojan ( 7000000f1 )
K7AntiVirusTrojan ( 7000000f1 )
BitDefenderThetaAI:Packer.93BAA7341E
VirITWorm.Win32.AutoRun.GTW
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
ESET-NOD32Win32/Dewnad.AA
APEXMalicious
TrendMicro-HouseCallWORM_DYBALOM.SMX
ClamAVWin.Worm.Autorun-514
KasperskyWorm.Win32.AutoRun.gtw
BitDefenderGen:Variant.Jacard.163999
NANO-AntivirusTrojan.Win32.AutoRun.bjfrh
AvastWin32:AutoRun-BHW [Wrm]
TencentMalware.Win32.Gencirc.115de7b5
EmsisoftGen:Variant.Jacard.163999 (B)
F-SecureTrojan.TR/Agent.135168.AA
BaiduWin32.Worm.AutoRun.cl
VIPREGen:Variant.Jacard.163999
TrendMicroWORM_DYBALOM.SMX
Trapminesuspicious.low.ml.score
SophosMal/Generic-S
IkarusWorm.Win32.Bybz
GDataGen:Variant.Jacard.163999
JiangminWorm/AutoRun.lsh
WebrootW32.Backdoor.Gen
GoogleDetected
AviraTR/Agent.135168.AA
VaristW32/SelfStarterInternetTrojan!M
Antiy-AVLWorm/Win32.AutoRun
Kingsoftmalware.kb.a.1000
XcitiumWorm.Win32.Dewnad.AA1@1lq9s7
ArcabitTrojan.Jacard.D2809F
ViRobotWorm.Win32.Autorun.135168.AD
ZoneAlarmWorm.Win32.AutoRun.gtw
MicrosoftBackdoor:Win32/IRCbot!pz
CynetMalicious (score: 100)
AhnLab-V3Worm/Win32.AutoRun.R2220
ALYacGen:Variant.Jacard.163999
MAXmalware (ai score=89)
MalwarebytesBackdoor.IRCBot
PandaGeneric Malware
RisingBackdoor.IRCbot!8.B47 (TFE:5:wiSfZuXl46)
YandexTrojan.GenAsa!vKQtconx/FA
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.24443.susgen
FortinetW32/AutoRun.GTW!worm
AVGWin32:AutoRun-BHW [Wrm]
DeepInstinctMALICIOUS
alibabacloudTrojan.Win.UnkAgent

How to remove Backdoor:Win32/IRCbot!pz?

Backdoor:Win32/IRCbot!pz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment