Backdoor:Win32/Xtrat!rfn (file analysis)

Malware Removal

The Backdoor:Win32/Xtrat!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Review

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Backdoor:Win32/Xtrat!rfn virus can do?

  • Injection (inter-process)
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Uses Windows utilities for basic functionality
  • Code injection with CreateRemoteThread in a remote process
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
devil-pkc.ddns.net

How to determine Backdoor:Win32/Xtrat!rfn?


File Info:

crc32: 39CB0EBF
md5: aabb2bbefda78400cae61442ca9938b9
name: a.jpg
sha1: d0873637bbc07b176c6f4fc3ef4f43448d00a42e
sha256: d9df282662bc66f6c53a02359850b49064b74c979e05a3b98064ae97b3e19a1f
sha512: 7a7ca5d80e984ca8038def579f4b4fbc3ba77d310ea4e9aa1ae4b5fe4409a774eb65d70076a44bd1c6a3ceea29006e3092261e34eeadb78a214e0cd96e1f369e
ssdeep: 768:7MuijtHf5g7/IIG3bGcYDBSvFIWuePQtv66lttzeal:ANW71rcYDAWeotvXlri
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Backdoor:Win32/Xtrat!rfn also known as:

BkavW32.FeylarmQ.Trojan
MicroWorld-eScanTrojan.Delf.Agent.AH
nProtectTrojan/W32.Sasfis.33792.P
CMCBackdoor.Win32.Xtrat.1!O
CAT-QuickHealBackdoor.Xtrat.AA8
McAfeeGenericRXAA-EO!AABB2BBEFDA7
MalwarebytesTrojan.Agent
VIPRETrojan.Win32.Xpack.a (v)
AegisLabW32.W.QQPass.kYLv
K7AntiVirusTrojan ( 0038dcf91 )
K7GWTrojan ( 0038dcf91 )
TheHackerTrojan/Remtasu.a
BaiduWin32.Backdoor.Agent.ag
F-ProtW32/Xtrat.A.gen!Eldorado
SymantecW32.Extrat!gen1
ESET-NOD32Win32/AutoRun.Remtasu.E
TrendMicro-HouseCallTSPY_KEYLOG.SMC
AvastWin32:Malware-gen
ClamAVWin.Trojan.Agent-36788
KasperskyBackdoor.Win32.Xtreme.bqj
BitDefenderTrojan.Delf.Agent.AH
NANO-AntivirusTrojan.Win32.Sasfis.dzcfs
SUPERAntiSpywareTrojan.Agent/Gen-CryptedInstaller
Ad-AwareTrojan.Delf.Agent.AH
SophosMal/SillyFDC-A
ComodoTrojWare.Win32.Kryptik.BTN
F-SecureRogue:W32/FakeAv.BI
DrWebBackDoor.Siggen.52725
ZillyaTrojan.Sasfis.Win32.18817
TrendMicroTSPY_KEYLOG.SMC
McAfee-GW-EditionBehavesLike.Win32.Backdoor.nc
EmsisoftTrojan.Delf.Agent.AH (B)
CyrenW32/Xtrat.A.gen!Eldorado
JiangminTrojanSpy.Keylogger.grj
AviraBDS/Backdoor.Gen5
FortinetW32/Sasfis.BZMX!tr
Antiy-AVLTrojan[Backdoor]/Win32.Xtreme.bqj
ArcabitTrojan.Delf.Agent.AH
ViRobotBackdoor.Win32.Xtreme.Gen[h]
MicrosoftBackdoor:Win32/Xtrat!rfn
AhnLab-V3Trojan/Win32.Injector.N2067454007
ALYacTrojan.Delf.Agent.AH
AVwareTrojan.Win32.Xpack.a (v)
VBA32Backdoor.Poison
ZonerTrojanDownloader.Remtasu.F
TencentWin32.Backdoor.Xtreme.Lplj
YandexBackdoor.XTrat.Gen
IkarusTrojan-Spy.Win32.KeyLogger
GDataTrojan.Delf.Agent.AH
AVGCryptic.CWS
PandaTrj/Keylogger.GM
Qihoo-360Win32/Backdoor.Xtreme.A

How to remove Backdoor:Win32/Xtrat!rfn?

Backdoor:Win32/Xtrat!rfn removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment