Categories: Backdoor

Backdoor:Win32/Plugx!B (file analysis)

The Backdoor:Win32/Plugx!B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor:Win32/Plugx!B virus can do?

  • Attempts to connect to a dead IP:Port (2 unique times)
  • Creates RWX memory
  • Anomalous binary characteristics

How to determine Backdoor:Win32/Plugx!B?


File Info:

crc32: DBFD46C9md5: 0560b52f6229ee7c29243749241510b7name: 0560B52F6229EE7C29243749241510B7.mlwsha1: 3f8a3a9f7ab213eeba258448fd6076e4a9516b7dsha256: 3cdd33dea12f21a4f222eb060e1e8ca8a20d5f6ca0fd849715f125b973f3a257sha512: 3cca683ac4d12321de715801e26ca7214dcd33013879366d62688f8c0c551fbbfaca8350c4327c7b372597b0406e076983f8db3c9b72a46bc533f1e540f0926essdeep: 3072:TXhd7tKQ6D6+or3Dnov39gyQ21MkBX+s+bd8wCnTFaEiTwuenMrk:NLKNDuTov39K21MkBX+Hd8wQiT8Mrtype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Backdoor:Win32/Plugx!B also known as:

Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Gulpix.m!c
Elastic malicious (high confidence)
DrWeb DLOADER.Trojan
ClamAV Win.Trojan.Plugx-9758632-0
CAT-QuickHeal Backdoor.Gulpix
ALYac Gen:Variant.Bulz.408223
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Backdoor:Win32/Gulpix.aa3d2eb7
ESET-NOD32 a variant of Win32/Korplug.JM
APEX Malicious
Avast FileRepMalware
Cynet Malicious (score: 99)
Kaspersky Backdoor.Win32.Gulpix.xxm
BitDefender Gen:Variant.Bulz.408223
NANO-Antivirus Trojan.Win32.Korplug.feoqzs
ViRobot Trojan.Win32.Z.Korplug.245760
MicroWorld-eScan Gen:Variant.Bulz.408223
Tencent Win32.Backdoor.Gulpix.Eei
Ad-Aware Gen:Variant.Bulz.408223
Sophos Mal/Generic-S
Comodo Malware@#3hz3oto0af4q5
F-Secure Trojan.TR/Korplug.jzvgh
BitDefenderTheta Gen:NN.ZedlaF.34050.pq4@a0VsWYd
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DGN21
McAfee-GW-Edition RDN/Generic BackDoor
FireEye Generic.mg.0560b52f6229ee7c
Emsisoft Gen:Variant.Bulz.408223 (B)
SentinelOne Static AI – Suspicious PE
Jiangmin Backdoor.Gulpix.jj
Avira TR/Korplug.jzvgh
Antiy-AVL Trojan[Backdoor]/Win32.Gulpix
Kingsoft Win32.Hack.Undef.(kcloud)
Microsoft Backdoor:Win32/Plugx.gen!B
Arcabit Trojan.Bulz.D63A9F
ZoneAlarm Backdoor.Win32.Gulpix.xxm
GData Gen:Variant.Bulz.408223
AhnLab-V3 Malware/Win32.Generic.C2628772
McAfee RDN/Generic BackDoor
MAX malware (ai score=88)
VBA32 Backdoor.Gulpix
Panda Trj/GdSda.A
TrendMicro-HouseCall TROJ_GEN.R002C0DGN21
Yandex Backdoor.Gulpix!+t8OHyJHlpo
Ikarus Trojan.Win32.Korplug
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Korplug.JM!tr
AVG FileRepMalware
Paloalto generic.ml
Qihoo-360 Win32/Backdoor.PlugX.HgkASZEA

How to remove Backdoor:Win32/Plugx!B?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Trojan.Swrort.S23689749 removal

The Trojan.Swrort.S23689749 is considered dangerous by lots of security experts. When this infection is active,…

55 seconds ago

Zusy.318182 removal

The Zusy.318182 is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

Win32:Regrun-LY [Trj] (file analysis)

The Win32:Regrun-LY [Trj] is considered dangerous by lots of security experts. When this infection is…

2 hours ago

MSIL/Kryptik.AJRE (file analysis)

The MSIL/Kryptik.AJRE is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

Trojan.Generic.35780066 removal

The Trojan.Generic.35780066 is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

Win32/Agent.AFBR information

The Win32/Agent.AFBR is considered dangerous by lots of security experts. When this infection is active,…

3 hours ago