Sock.Backdoor.Bot.DDS (file analysis)

The Sock.Backdoor.Bot.DDS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Sock.Backdoor.Bot.DDS virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Sock.Backdoor.Bot.DDS?


File Info:
name: 7F15ADC186C76601D684.mlw
path: /opt/CAPEv2/storage/binaries/cffc9c97b8d6a4f0d83ceb32a6548b335da55a3017c68a2dedfaa410ffceff3f
crc32: B8E6E6C4
md5: 7f15adc186c76601d684102a17cdce84
sha1: 416169a9ff259ec3983ad85536b3b2a95bfc1ef4
sha256: cffc9c97b8d6a4f0d83ceb32a6548b335da55a3017c68a2dedfaa410ffceff3f
sha512: abfc13f49e79847ce541bd8045df19f6a04e065597cedddf307177864f93856b7e8b0e0327e657658392060b0790146bd535425a3558815d9b2bcc46a083d2f8
ssdeep: 768:uYAjI/52wGAyUtxJYfYuFFkghPjYeIeeqk:9Ac/52wGAyUcYulPUeIeeqk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13E532B5AAB46EC77C4ED05F66B64480A7FBFFE3116A85707CB00224D6CF65C7E824289
sha3_384: b118c11365c7287144ace8796e65a6915ab83c3df4749c9a0dbfab5c6edc309825e9d9095f563b7747d17bc0e7a086ce
ep_bytes: 00000000000000000000000000000000
timestamp: 2008-04-19 08:02:16

Version Info:
0: [No Data]

Sock.Backdoor.Bot.DDS also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Trojan.GenericKDZ.70943
FireEye	Generic.mg.7f15adc186c76601
ALYac	Trojan.GenericKDZ.70943
Cylance	unsafe
VIPRE	Trojan.GenericKDZ.70943
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 004bcce41 )
K7GW	Trojan ( 004bcce41 )
Cybereason	malicious.186c76
Baidu	Win32.Backdoor.IRCBot.a
Cyren	W32/Backdoor.J.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
APEX	Malicious
BitDefender	Trojan.GenericKDZ.70943
Avast	Win32:Socks-AC [Wrm]
Emsisoft	Trojan.GenericKDZ.70943 (B)
F-Secure	Worm.WORM/Socks.ex
TrendMicro	TROJ_GEN.R03BC0DEL23
McAfee-GW-Edition	BehavesLike.Win32.Generic.kz
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKDZ.70943
Avira	WORM/Socks.ex
Antiy-AVL	Trojan[Backdoor]/Win32.Koceg
Arcabit	Trojan.Generic.D1151F
Microsoft	Backdoor:Win32/Koceg.gen!A
Cynet	Malicious (score: 100)
McAfee	Artemis!7F15ADC186C7
MAX	malware (ai score=83)
Malwarebytes	Sock.Backdoor.Bot.DDS
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R03BC0DEL23
Rising	Worm.Socks!1.A966 (CLASSIC)
Ikarus	Backdoor.Win32.Koceg
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/GenericKDZ.70943!dam
AVG	Win32:Socks-AC [Wrm]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Sock.Backdoor.Bot.DDS?

Sock.Backdoor.Bot.DDS removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X