Backdoor:Win32/Qakbot!A information

The Backdoor:Win32/Qakbot!A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Qakbot!A virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Backdoor:Win32/Qakbot!A?

File Info:
name: 8EAF5F8EE227E55AE164.mlw
path: /opt/CAPEv2/storage/binaries/b5b72ba57b4951cb5cd9ee397ea57a249aad4931af332a96f51c237e404c43ab
crc32: B94E1F46
md5: 8eaf5f8ee227e55ae1643423573bba64
sha1: aa00db4477137183e256fff0bb20548f1559dbc6
sha256: b5b72ba57b4951cb5cd9ee397ea57a249aad4931af332a96f51c237e404c43ab
sha512: 1694559658140937d76b5eed7a165717522c5110c21a33c3726e3d3a268d3b96b56631aaae94753059e3addf8878c49a6a52af40b4d7e300e9b5ecb34e1e1e58
ssdeep: 1536:PpxfQ0Gs1sPbZrjyXi7EV0uIjE3XyTwO:j0hSi7HTrP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E943F1A9B2E1129BE3E753F9B42361D7D175E297A71B1F0484D390331A8AD12880BE77
sha3_384: 9292b70a717aa2c10384f126c25e3e3c6c864e2807bceeb61fe87dd47e88ab088c2e958ac6f5c505115cccfbcbc2b135
ep_bytes: 60be007041008dbe00a0feff5783cdff
timestamp: 2004-04-23 17:29:01

Version Info:
CompanyName: фзБЗЙЙхэЦуАЮплэЦйлъжьВЪМюСЪРюБчУЪцс
FileDescription: дСцбвосТаПнрюТХмцЦжчЯАбчэажфЫЖъ
FileVersion: 11.58.14.29
InternalName: ШюачСРюяЖЬЯаСИГЪозЬрЮъцНьзхЛаКПпЬичЕ
LegalCopyright: 3567-2498
OriginalFilename: Ew2xGuw.exe
ProductName: ВЩНщмДДЖсХХЛЗГаЫКСФМЩзБЕрпЖВзтспэБсЫДД
ProductVersion: 11.58.14.29
Translation: 0x04b0 0x0417

Backdoor:Win32/Qakbot!A also known as:

How to remove Backdoor:Win32/Qakbot!A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.