Categories: Backdoor

Backdoor:Win32/Turkojan.AI (file analysis)

The Backdoor:Win32/Turkojan.AI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Turkojan.AI virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process created a hidden window
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Deletes its original binary from disk
Sniffs keystrokes
Installs itself for autorun at Windows startup
Creates a copy of itself
Attempts to disable UAC
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor:Win32/Turkojan.AI?


File Info:
crc32: 7AD79526md5: 53aa23b5ca5a46a7af7d15404fb80170name: turko.exesha1: 17a68bd6c1a548ca2bb12de8e648d6ce0e2c1a7asha256: ac14a9c8c3303318670e6bfe019f3a41d9411a4dc4f797f8477f1d1074459237sha512: 07b4b1d43a3a308dad20d7dbaa27996cb2b11edede70cee6d3283315075935c1074547e048d2de38d6a074aa7857c2ade0e1505251512d955dbcb7407b2c58e0ssdeep: 3072:Yoy8j7VnNdrPHaSekwi+mW+2jLcJkz0dout:o8jZ7rvaU3+mWrjLM3doStype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
0: [No Data]

Backdoor:Win32/Turkojan.AI also known as:

Bkav	W32.MstwainCmseLnr.Trojan
DrWeb	Win32.HLLW.MyBot
MicroWorld-eScan	Backdoor.Turkojan.AF
FireEye	Generic.mg.53aa23b5ca5a46a7
CAT-QuickHeal	Backdoor.Turkojan.A8
Qihoo-360	Backdoor.Win32.Turkojan.B
ALYac	Backdoor.Turkojan.AF
Cylance	Unsafe
Zillya	Backdoor.Turkojan.Win32.26829
Sangfor	Malware
K7AntiVirus	Trojan ( 0002ec661 )
BitDefender	Backdoor.Turkojan.AF
K7GW	Trojan ( 0002ec661 )
CrowdStrike	win/malicious_confidence_100% (W)
Invincea	heuristic
BitDefenderTheta	AI:Packer.B0A5041719
Cyren	W32/Turkojan.C.gen!Eldorado
Symantec	Backdoor.Trojan
TotalDefense	Win32/Turkojan.A
APEX	Malicious
Avast	Win32:Morphine-CD [Trj]
ClamAV	Win.Trojan.Truko-10
GData	Backdoor.Turkojan.AF
Kaspersky	Backdoor.Win32.Turkojan.zwh
Alibaba	Backdoor:Win32/Turkojan.448227e4
NANO-Antivirus	Trojan.Win32.Turkojan.jebp
ViRobot	Backdoor.Win32.Turkojan.110592.W
AegisLab	Trojan.Win32.Turkojan.l4sV
Tencent	Malware.Win32.Gencirc.10b0cccb
Ad-Aware	Backdoor.Turkojan.AF
Sophos	Troj/Agent-GMF
Comodo	Backdoor.Win32.turkojan.ek6@1kjvh2
F-Secure	Backdoor:W32/Turkojan.gen!A
Baidu	Win32.Backdoor.Cakl.c
VIPRE	Backdoor.Win32.Turkojan.il (v)
TrendMicro	BKDR_TURKOJN.SMD
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.cc
Trapmine	malicious.high.ml.score
CMC	Trojan-Dropper.Win32.Typic!O
Emsisoft	Backdoor.Turkojan.AF (B)
Ikarus	Trojan.Win32.Cakl
F-Prot	W32/Turkojan.C.gen!Eldorado
Jiangmin	Backdoor/Turkojan.x
Webroot	W32.Trojan.Gen
Avira	BDS/Turkojan.im
Antiy-AVL	Trojan/Win32.Turkojan.gic
Endgame	malicious (moderate confidence)
Arcabit	Backdoor.Turkojan.AF
SUPERAntiSpyware	Trojan.Agent/Gen-Frauder[Twain]
ZoneAlarm	Backdoor.Win32.Turkojan.zwh
Microsoft	Backdoor:Win32/Turkojan.AI
TACHYON	Trojan/W32.DP-Agent.276992.F
AhnLab-V3	Trojan/Win32.Turkojan.R1451
Acronis	suspicious
McAfee	BackDoor-CZP.dr
MAX	malware (ai score=100)
VBA32	Trojan.SDP.27105
Malwarebytes	Backdoor.Turkojan
Panda	Bck/Turkojan.X
Zoner	Trojan.Win32.32514
ESET-NOD32	Win32/Cakl.NAG
TrendMicro-HouseCall	BKDR_TURKOJN.SMD
Rising	Backdoor.Turkojan!1.66E8 (CLOUD)
Yandex	Backdoor.Turkojan.I
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/Agent.GMF!tr.bdr
AVG	Win32:Morphine-CD [Trj]
Cybereason	malicious.5ca5a4
Paloalto	generic.ml
MaxSecure	Trojan.BackDoor-CZP.Dr