Backdoor:Win32/Turla.AC information

The Backdoor:Win32/Turla.AC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Turla.AC virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• .NET file is packed/obfuscated with Confuser
• Authenticode signature is invalid
• Anomalous .NET characteristics
• Collects and encrypts information about the computer likely to send to C2 server

How to determine Backdoor:Win32/Turla.AC?

File Info:
name: A029007534B95C2BD8E2.mlw
path: /opt/CAPEv2/storage/binaries/8490daab736aa638b500b27c962a8250bbb8615ae1c68ef77494875ac9d2ada2
crc32: 94F7296C
md5: a029007534b95c2bd8e29e80f97f292d
sha1: 71458cf1ff75e90d555fdd60461366fbc51d4b6d
sha256: 8490daab736aa638b500b27c962a8250bbb8615ae1c68ef77494875ac9d2ada2
sha512: 5976821a2b25ae8b30c75e41e227ab7b16c28ceb6aef74c43b96b9ac8e74dd418ae312c4aa23c8956a7ce6039e5ebd7a8301e731128ac994ea2edd1790bbb6a4
ssdeep: 6144:NHWweNhhFDSieKocE6tSY1hOKUWocOo1CEJv:NH+BYXcE6tRzOKUWocOo1CEh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18F344B083B949A4FC65F8F76E9905A10A370E96B570BE74774C327FC1D4E3AA8E015E2
sha3_384: d9fab50b0ef2e3b09bb7bb84e49fac6dc227a41491595e0d7b85a2612d0cae8917915dc8aa065f5e4613c702d506fcee
ep_bytes: ff250020400000000000000000000000
timestamp: 2016-04-21 11:15:12

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: Agent.exe
LegalCopyright:  
OriginalFilename: Agent.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Backdoor:Win32/Turla.AC also known as:

How to remove Backdoor:Win32/Turla.AC?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.