Categories: Backdoor

Backdoor:Win32/Xtrat.B removal guide

The Backdoor:Win32/Xtrat.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Xtrat.B virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
CAPE detected the Xtreme malware family
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Backdoor:Win32/Xtrat.B?


File Info:
name: B7ACE9DD6FD990D67F08.mlwpath: /opt/CAPEv2/storage/binaries/837055cd51f13c92b43b3e7d9e5a141224bace91d3f39e1a8db5bd7ea5f7e74acrc32: 37C76C84md5: b7ace9dd6fd990d67f086dfbe70f9d3bsha1: 22e1bce177eb9e2b67cf4dc7bd68027f942ca46fsha256: 837055cd51f13c92b43b3e7d9e5a141224bace91d3f39e1a8db5bd7ea5f7e74asha512: 5f07e66270093c52b3d57d7fb91b5ec5a17758532aea746c1cfaf1af744bb3be5c6c7ecf0263543474bfe2e394e803a680b1374310cc66c073a38088e3daa213ssdeep: 768:NB7+tTFH90iY6W1jwmDzKgEFQXKklzIAn38hwfOgw0c0zova:zCBg31jxPEFQXKkx384bpovatype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T145233B22A7BC0571E0721B7C8C9DD119F47E7D311A32B45EF18A1E4E84763D27A2972Bsha3_384: 90dcf1205754eb42c9d97305defb34d90ead1fcc24d5fb3442629cb341705ea85961279e9a39408bb8a2c2c0f5a84114ep_bytes: 548bec81c4e8f7ffff53565733c08985timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Backdoor:Win32/Xtrat.B also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Xtreme.ldwI
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Ransom.Loki.22023
ClamAV	Win.Trojan.Xtreme-7
FireEye	Generic.mg.b7ace9dd6fd990d6
CAT-QuickHeal	Backdoor.Xtrat.AA8
Skyhigh	BehavesLike.Win32.ExploitMydoom.ph
McAfee	BackDoor-FCDE!B7ACE9DD6FD9
Cylance	unsafe
Zillya	Trojan.Remtasu.Win32.4984
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Backdoor ( 003708201 )
Alibaba	Backdoor:Win32/Xtreme.e308ed9f
K7GW	Backdoor ( 003708201 )
Cybereason	malicious.177eb9
Arcabit	Trojan.Ransom.Loki.D5607
Baidu	Win32.Trojan.Remtasu.a
VirIT	Backdoor.Win32.Xtreme.BID
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Remtasu.O
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Xtreme.gen
BitDefender	Gen:Variant.Ransom.Loki.22023
NANO-Antivirus	Trojan.Win32.Virtumod.ejzzyt
Avast	Win32:BackDoor-ABH [Trj]
Tencent	Backdoor.Win32.Xtreme.bid
Emsisoft	Gen:Variant.Ransom.Loki.22023 (B)
F-Secure	Backdoor.BDS/Xtrat.46080125
DrWeb	Trojan.Virtumod.11842
VIPRE	Gen:Variant.Ransom.Loki.22023
Sophos	Troj/Keylog-OI
Ikarus	Backdoor.Win32.Xtreme
Jiangmin	Trojan/XtremeKeylogger.y
Webroot	W32.Virus.Gen
Google	Detected
Avira	BDS/Xtrat.46080125
Antiy-AVL	Trojan[Backdoor]/Win32.Xtreme.bid
Kingsoft	Win32.HeurC.KVMH017.a
Xcitium	Malware@#30xoce2kc4w7d
Microsoft	Backdoor:Win32/Xtrat.B
ViRobot	Backdoor.Win32.A.Xtreme.21504.C
ZoneAlarm	Backdoor.Win32.Xtreme.gen
GData	Win32.Trojan.PSE.16VWBSU
Varist	W32/Xtrat.C.gen!Eldorado
AhnLab-V3	Backdoor/Win32.Xtreme.R32518
BitDefenderTheta	AI:Packer.1FD3C0E121
ALYac	Gen:Variant.Ransom.Loki.22023
MAX	malware (ai score=100)
VBA32	BScope.Backdoor.Xtreme
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/CI.A
Rising	Backdoor.Xtrat!1.6A25 (CLASSIC)
Yandex	Backdoor.Xtreme!O6kkEpjHbHk
SentinelOne	Static AI – Malicious PE
MaxSecure	Backdoor.Xtreme.azc
Fortinet	W32/TRATS.SMM!tr.bdr
AVG	Win32:BackDoor-ABH [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)