Backdoor:Win32/Kelihos!pz (file analysis)

The Backdoor:Win32/Kelihos!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Kelihos!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Attempts to access Bitcoin/ALTCoin wallets
• Touches a file containing cookies, possibly for information gathering
• Harvests credentials from local FTP client softwares
• Installs WinPCAP
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Kelihos!pz?

File Info:
name: 8D5DB354EB48BDFEB624.mlw
path: /opt/CAPEv2/storage/binaries/7efd885f60c6a25fd1890d80a5bc0e012243ad9610f69e1c277fe8ce349345cc
crc32: 90923773
md5: 8d5db354eb48bdfeb624c12d9a0a1190
sha1: d1e3d188545a7da98d663096ec7c5453843ef75a
sha256: 7efd885f60c6a25fd1890d80a5bc0e012243ad9610f69e1c277fe8ce349345cc
sha512: 784e5b84c10ff74604eac19fce822f40d47f913aa2bc2749f914aa36100ddd715b48f425ed0dadea3de2150fc173e0ec660ecd0f20e4fed7ec72036c77472cdf
ssdeep: 12288:iyrOQCTepqK5JbQtZWhQx2tb7Pbwv2ndejXxQMcKZcNZVlFslMchF41pj/+/ALAJ:bgTOXstZIP9Ccdejx5ZcR9chFR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1820523429AB64CDCD846C83EB225E88341519F1EFBB8D76E600E54FAB49F4B30715EE1
sha3_384: eb042acb47fcf7d1131073772e997db7a1c6fe8b28cd27e796c67520958d5ea9b687ffbb8e4ca26f29712232aec47cc0
ep_bytes: 66ba00ff8bcc663bca726bb96b324000
timestamp: 2001-01-03 18:51:33

Version Info:
0: [No Data]

Backdoor:Win32/Kelihos!pz also known as:

How to remove Backdoor:Win32/Kelihos!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.