Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Backdoor
Threat report

Backdoor:Win32/Y3KRatpro.0_2 removal

Published May 1, 2024 Backdoor category 3 min read
Report context

What to verify before removal

Backdoor:Win32/Y3KRatpro.0_2 removal deserves a credential-safety review because this backdoor label can overlap with remote access, browser data theft, or persistence after reboot. Cleanup should include scanning the file, removing the persistence point, and rotating exposed passwords from a clean device.

Start by comparing the local file name with 744DE367E82F36AF72CE.mlw, then review the behavior notes for credential theft, browser data access, remote-control activity, and persistence after reboot. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
744DE367E82F36AF72CE.mlw
  • Compare the suspicious file name with 744DE367E82F36AF72CE.mlw.
  • Confirm the detection name matches Backdoor:Win32/Y3KRatpro.0_2 removal before removing related files.
  • Review the report for credential theft, browser data access, remote-control activity, and persistence after reboot so the cleanup is based on observed behavior, not only the label.
  • After cleanup, rotate passwords from a clean device and review browser sessions or saved credentials.

The Backdoor:Win32/Y3KRatpro.0_2 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Backdoor:Win32/Y3KRatpro.0_2 virus can do?

  • Sample contains Overlay data
  • Reads data out of its own binary image
  • Unconventionial language used in binary resources: Greek
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • CAPE detected the Beastdoor malware family
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Y3KRatpro.0_2?



File Info:

name: 744DE367E82F36AF72CE.mlw
path: /opt/CAPEv2/storage/binaries/0170ab3a875613ad0c9a14c5c0f652d10bb4f4fb4163259585263fbe78650d54
crc32: 0273D6C1
md5: 744de367e82f36af72ce7db6144b675a
sha1: 49d463db9565abf72419f0f221782d03af2fde04
sha256: 0170ab3a875613ad0c9a14c5c0f652d10bb4f4fb4163259585263fbe78650d54
sha512: 650324f09dde8167fdb88e937314cc528faa9406f90a8fe12cadeb2c662883189421639d3699fb54cf1e58f25ce618f8822a282f9c5d5eb30404b3317bc76c93
ssdeep: 12288:+oqYCy3py+MLYTSrE8NrY+7G63XqDkwBWKsafOL2+K:+oqYbgrgarY+dXqDN4KsafOL2+K
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C5B47D26F680C47BD0730F388C5B92995529FB302E3894477BE85F4C9F762D16E2A2D6
sha3_384: 64305956aa6fe0895e2cc4dced526be84272bc786f4121280fdc1ef4a834889ce33e619c42eae9d0315f111e35a963da
ep_bytes: 558becb9060000006a006a004975f951
timestamp: 1992-06-19 22:22:17


Version Info:

0: [No Data]

Backdoor:Win32/Y3KRatpro.0_2 also known as:

Elastic malicious (high confidence)
MicroWorld-eScan Generic.Keylogger.2.DCB0118F
FireEye Generic.mg.744de367e82f36af
Skyhigh BehavesLike.Win32.Dropper.gh
McAfee BackDoor-GQ.a
Malwarebytes Generic.Malware/Suspicious
VIPRE Generic.Keylogger.2.DCB0118F
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 7000000f1 )
Alibaba Backdoor:Win32/Latinus.275a9baa
K7GW Trojan ( 7000000f1 )
BitDefenderTheta Gen:NN.ZelphiF.36804.FGX@aiko1UhG
VirIT Backdoor.Win32.Y3KRat.C
Symantec Backdoor.Y3KRat
ESET-NOD32 Win32/Y3KRat.Pro.02
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
BitDefender Generic.Keylogger.2.DCB0118F
NANO-Antivirus Trojan.Win32.Y3KRat.crqcah
Tencent Malware.Win32.Gencirc.1403ad82
Emsisoft Generic.Keylogger.2.DCB0118F (B)
F-Secure Backdoor.BDS/Y3KRat.Pro.3
DrWeb BackDoor.Y3krat.2
Zillya Backdoor.Y3KRat.Win32.128
TrendMicro BKDR_Y3KRAT.02
Trapmine malicious.high.ml.score
Sophos Mal/Keylog-A
Ikarus Backdoor.Win32.Latinus
Jiangmin Backdoor/Y3kRAT.pro.02
Webroot W32.Backdoor.Gen
Varist W32/Y3kRat.ZMTV-1843
Avira BDS/Y3KRat.Pro.3
Antiy-AVL Trojan[Backdoor]/Win32.Y3KRat
Kingsoft malware.kb.a.1000
Microsoft Backdoor:Win32/Y3KRatpro.0_2
Xcitium Backdoor.Win32.Y3KRat.Pro.02@2cza
Arcabit Generic.Keylogger.2.DCB0118F
ZoneAlarm Backdoor.Win32.Y3KRat.pro.02
GData Generic.Keylogger.2.DCB0118F
Google Detected
VBA32 suspected of Trojan-PSW.Agent.4
ALYac Generic.Keylogger.2.DCB0118F
MAX malware (ai score=100)
DeepInstinct MALICIOUS
Cylance unsafe
TrendMicro-HouseCall BKDR_Y3KRAT.02
Rising Trojan.Y3kratPro.02 (CLASSIC)
Yandex Trojan.GenAsa!/zeudJAgj/w
SentinelOne Static AI – Suspicious PE
Fortinet W32/Y3KRatPro.V102!tr.bdr
Panda Backdoor Program
alibabacloud Backdoor:Win/Y3KRat.Pro

How to remove Backdoor:Win32/Y3KRatpro.0_2?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.