Categories: Backdoor

Backdoor:Win32/VB.UN (file analysis)

The Backdoor:Win32/VB.UN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/VB.UN virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Authenticode signature is invalid
Created a service that was not started
Anomalous binary characteristics
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/VB.UN?


File Info:
name: 01DC9DB462476DE70592.mlwpath: /opt/CAPEv2/storage/binaries/1cceddca2f1b5631895bac017cc8920337eae2d5b50023c4e97d0d073cae47e5crc32: 3801EF04md5: 01dc9db462476de705926241350ad5bbsha1: f59970ae175a27aab1f906ac2359450cdef5e886sha256: 1cceddca2f1b5631895bac017cc8920337eae2d5b50023c4e97d0d073cae47e5sha512: 0f86039fb1014f3814f867f3ebb1e95ad94a73e725779c262e845a927d4963e5c23a6b9d8ba8571277301d98a359e7d3b480b5c2a5f52cddd0b4be51519a0312ssdeep: 1536:myi9qQguQc0TB/H3EF5ilWNmsLmxGcHCeh76hV:Fi9qQgudIv3EF5ilScxvHCY76type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T115342A17631888C4F6D4A9310A97CCB586F2FC235AD77B9316C02A7E3C33E51E925A5Esha3_384: 23d69831efab38c1af325142c1a4b993550a94b3ab719ea53336ca92f6017323933db13424a5a4d132118ef5b78d63a3ep_bytes: 6840134000e8eeffffff000000000000timestamp: 2004-02-12 15:43:54
Version Info:
0: [No Data]

Backdoor:Win32/VB.UN also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.VB.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	MemScan:Trojan.GenericKDZ.99403
ClamAV	Win.Trojan.Redjunk-6817436-0
FireEye	Generic.mg.01dc9db462476de7
CAT-QuickHeal	Backdoor.Pcclient.9421
ALYac	MemScan:Trojan.GenericKDZ.99403
Cylance	unsafe
Zillya	Trojan.VB.Win32.923124
K7AntiVirus	P2PWorm ( 0000f53f1 )
BitDefender	MemScan:Trojan.GenericKDZ.99403
K7GW	P2PWorm ( 0000f53f1 )
Cybereason	malicious.462476
Arcabit	Trojan.Generic.D1844B
BitDefenderTheta	AI:Packer.BC437D5515
Cyren	W32/Backdoor.KAPY-0306
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	Win32/VB.UN
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.VB.un
Alibaba	Worm:Win32/vobfus.1030
NANO-Antivirus	Trojan.Win32.VB.eyodli
ViRobot	Backdoor.Win32.A.VB.239583
Rising	Backdoor.VB.nin (CLASSIC)
TACHYON	Backdoor/W32.VB-Agent.239583
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Patched.Ren.Gen
DrWeb	BackDoor.Netian
VIPRE	MemScan:Trojan.GenericKDZ.99403
TrendMicro	WORM_WATSOON.C
McAfee-GW-Edition	BehavesLike.Win32.Generic.dz
Emsisoft	MemScan:Trojan.GenericKDZ.99403 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor/VB.nmd
Avira	TR/Patched.Ren.Gen
Antiy-AVL	Trojan[Backdoor]/Win32.VB
Xcitium	Backdoor.Win32.VB.UN@3wmt
Microsoft	Backdoor:Win32/VB.UN
ZoneAlarm	Backdoor.Win32.VB.un
GData	MemScan:Trojan.GenericKDZ.99403
Google	Detected
AhnLab-V3	Trojan/Win32.Xema.C36261
McAfee	GenericRXAA-AA!01DC9DB46247
MAX	malware (ai score=84)
DeepInstinct	MALICIOUS
VBA32	Backdoor.VB
Malwarebytes	Malware.AI.3518317298
Panda	Bck/Iroffer.BG
TrendMicro-HouseCall	WORM_WATSOON.C
Tencent	Malware.Win32.Gencirc.10beb31c
Ikarus	Trojan.Win32.VB
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/VB.UN!tr.bdr
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_100% (W)