Backdoor:Win32/Remcos!mclg information

The Backdoor:Win32/Remcos!mclg is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Remcos!mclg virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Arabic (Jordan)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Detects BullGuard Antivirus through the presence of a library
• Detects Sandboxie through the presence of a library
• Detects SunBelt Sandbox through the presence of a library

How to determine Backdoor:Win32/Remcos!mclg?

File Info:
name: A1BD77437C6E7F6813B8.mlw
path: /opt/CAPEv2/storage/binaries/09e78c601be649601d88efd9cab2d3730176cbb0adc4a4105ec3e37af037e7bd
crc32: CEADDF8D
md5: a1bd77437c6e7f6813b893d8814d58ef
sha1: 64f28d1bf3717b380ef1d398f32fc372d0cf43ce
sha256: 09e78c601be649601d88efd9cab2d3730176cbb0adc4a4105ec3e37af037e7bd
sha512: c14de6a02b042f18588276c131abb4f51c29551ce14c98f75d6240249043525967da3f8b2c3b3555508bd0c07ea1668aec109210f3ff8b4161372f00d2de2587
ssdeep: 24576:1bbQa7ukSlLQnJEn3hscHldZM1RpzNownH19N5Yen/s/3jVRks6Lo3W0O:ZokScnS/NGTNoqNWP5Rx6LKtO
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C48512249971D239F4AF9BF05A7E4A6C362D7732632159CB73CA229F43B86D08930747
sha3_384: 90922e5af4e2b2778e1010c31e123df682a21e7136fd1d0b216d33260a0f467d55d37777012bd98479276ad09b7c81f1
ep_bytes: 8bff558bece846040000e8110000005d
timestamp: 2022-06-20 08:13:01

Version Info:
FileVersion: 5.75.85.11
LegalCopyright: Copyright Ⓒ 2012-2022 for Mad Inc.
ProductVersion: 42.0.10.27
Translation: 0x2c01 0x03b6

Backdoor:Win32/Remcos!mclg also known as:

How to remove Backdoor:Win32/Remcos!mclg?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.