Categories: Backdoor

Backdoor:Win32/Kanav.A (file analysis)

The Backdoor:Win32/Kanav.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Kanav.A virus can do?

Sample contains Overlay data
HTTPS urls from behavior.
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Attempts to modify proxy settings
Harvests cookies for information gathering
Uses suspicious command line tools or Windows utilities

How to determine Backdoor:Win32/Kanav.A?


File Info:
name: 4B246D09E60C4EC49B87.mlwpath: /opt/CAPEv2/storage/binaries/660cf77581e8a94bbf54c8154c154c007a5f3e6f3feb816591d7c7e0b88841decrc32: 3CEFEB75md5: 4b246d09e60c4ec49b87f88bc97e1e1csha1: 4eb73fdb020e701192fe287ff4d976d1dfbae74dsha256: 660cf77581e8a94bbf54c8154c154c007a5f3e6f3feb816591d7c7e0b88841desha512: abf829596776fdf9764b1e7099f478a29685fc22c24bb119aa192160a4f2ee528fee0874aa743c1b107b2e5a62c4dc7d21d75f7634da845a66b648d5f6a49b04ssdeep: 768:w37zj55N7fnokbb/RjUtS0xWboBK4hlwYB:wj55NzBv/1oc4hl9Btype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T109235B3B75C48476C582417105E48F6B9FBF2F31129211A367E0AD466E72ADAE22F20Esha3_384: 113e43471c0315016cc17867bb57d8aa12fb6d9d614aa95e6dafe41e0b4e2dda4b631227113121ff335d2906db946d8fep_bytes: 558bec6aff680071400068103f400064timestamp: 2011-12-16 15:36:39
Version Info:
0: [No Data]

Backdoor:Win32/Kanav.A also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.326892
ClamAV	Win.Trojan.Agent-364682
CAT-QuickHeal	Backdoor.Kanav.MUE.AP3
McAfee	Downloader-CRU
Cylance	unsafe
Zillya	Dropper.Agent.Win32.93517
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan-Downloader ( 00321db61 )
K7GW	Trojan-Downloader ( 00321db61 )
Cybereason	malicious.9e60c4
BitDefenderTheta	Gen:NN.ZexaF.36196.cmX@aeelGUk
Cyren	W32/Sadenav.G.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrojanDownloader.Agent.RAK
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Dropper.Win32.Agent.gfbs
BitDefender	Gen:Variant.Zusy.326892
NANO-Antivirus	Trojan.Win32.Agent.dayvyd
SUPERAntiSpyware	Trojan.Agent/Gen-Kanav
Avast	Win32:Inject-AQV [Trj]
Tencent	Trojan-Dropper.Win32.Agent.kb
TACHYON	Trojan/W32.Agent.47108.I
Emsisoft	Gen:Variant.Zusy.326892 (B)
Baidu	Win32.Trojan-Downloader.Agent.bl
F-Secure	Trojan.TR/Dldr.Agent.udwaf
DrWeb	Trojan.Inject.59293
VIPRE	Gen:Variant.Zusy.326892
McAfee-GW-Edition	BehavesLike.Win32.Downloader.pt
FireEye	Generic.mg.4b246d09e60c4ec4
Sophos	Troj/Kanav-A
Ikarus	Trojan.Win32.Alyak
GData	Win32.Trojan.PSE.1KYMKY
Jiangmin	TrojanDropper.Agent.bfzc
Webroot	W32.Trojan.Gen
Avira	TR/Dldr.Agent.udwaf
Antiy-AVL	Trojan[Dropper]/Win32.Agent
Xcitium	TrojWare.Win32.TrojanDownloader.Small.REK@4n2or7
Arcabit	Trojan.Zusy.D4FCEC
ViRobot	Trojan.Win32.Downloader.45094
ZoneAlarm	Trojan-Dropper.Win32.Agent.gfbs
Microsoft	Backdoor:Win32/Kanav.A
Google	Detected
AhnLab-V3	Dropper/Win32.OnlineGameHack.R18748
VBA32	BScope.Trojan.Jorik
ALYac	Gen:Variant.Zusy.326892
MAX	malware (ai score=89)
Malwarebytes	Malware.AI.1765439341
Panda	Trj/Genetic.gen
Rising	Backdoor.Kanav!1.9D4F (CLASSIC)
Yandex	Trojan.GenAsa!T94nMOBORCA
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.TODU!tr
AVG	Win32:Inject-AQV [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)