Categories: Backdoor

Should I remove “Backdoor:Win32/Talsab.C”?

The Backdoor:Win32/Talsab.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Talsab.C virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
A process created a hidden window
Drops a binary and executes it
Unconventionial language used in binary resources: Turkish
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

cust0.no-ip.org

How to determine Backdoor:Win32/Talsab.C?


File Info:
crc32: 48488ABCmd5: bc5d378a0d6e33ca3c4cc38b44c3277cname: BC5D378A0D6E33CA3C4CC38B44C3277C.mlwsha1: dde6d29f98f414127a6521c6f8bf81c6cd9bbe6fsha256: 1e05606fe623230d4c599b41a33e0022318d76571ce714c02f475b75c75187a0sha512: f9a2fd6c785b74b53f40142d5ce0e46334c133105880d2d1add1339885fa6a7adbbdff08f656587940c2a9d9ee5e8e934be7d7de51ae54a1041aadb3c1392d58ssdeep: 24576:SEB67u0UiWJSPKltDV5EzXnhsakfgCMMOnL/fSjCgk0+0A:SEYSBPl1Vo7kfDMMOLqktvtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Backdoor:Win32/Talsab.C also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.338102
FireEye	Generic.mg.bc5d378a0d6e33ca
Qihoo-360	Win32/TrojanSpy.Keylogger.HwUBOAUA
McAfee	Artemis!BC5D378A0D6E
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic.pak!cobra
BitDefender	Gen:Variant.Zusy.338102
Cybereason	malicious.a0d6e3
BitDefenderTheta	Gen:NN.ZelphiF.34590.lHW@aSNqa7aO
Cyren	W32/Risk.EZOC-1810
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.Swisyn.FF
APEX	Malicious
Avast	Win32:Talsab [Drp]
ClamAV	Win.Trojan.Swisyn-1754
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	TrojanSpy:Win32/KeyLogger.c5758944
NANO-Antivirus	Trojan.Win32.Yobdam.cdleg
AegisLab	Trojan.Win32.Generic.4!c
Rising	Ransom.Blocker!8.12A (TFE:4:G29ZdjksNnF)
Ad-Aware	Gen:Variant.Zusy.338102
Sophos	Mal/Generic-S
Comodo	Malware@#2qlrz88fmwbfw
F-Secure	Dropper.DR/Delphi.Gen
DrWeb	Trojan.MulDrop4.58214
Zillya	Backdoor.Yobdam.Win32.502
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tc
Emsisoft	Gen:Variant.Zusy.338102 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan/Swisyn.mwq
Avira	DR/Delphi.Gen
MAX	malware (ai score=81)
Antiy-AVL	Trojan[Backdoor]/Win32.Yobdam
Microsoft	Backdoor:Win32/Talsab.C
Arcabit	Trojan.Zusy.D528B6
AhnLab-V3	Trojan/Win32.Generic.C2102782
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Zusy.338102
Cynet	Malicious (score: 100)
VBA32	TrojanDropper.Agent
ALYac	Gen:Variant.Zusy.338102
TACHYON	Backdoor/W32.DP-Yobdam.1231360
Malwarebytes	Malware.AI.4194432034
Panda	Generic Malware
Tencent	Win32.Trojan.Generic.Pgwr
Yandex	Trojan.GenAsa!aT84Ys+N30c
Ikarus	Trojan.Win32.Bredolab
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Swisyn.NHT!tr
AVG	Win32:Talsab [Drp]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_80% (D)
MaxSecure	Trojan.Malware.2008190.susgen