Categories: Spy

What is “Spyware.Keydoor”?

The Spyware.Keydoor is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Spyware.Keydoor virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Scheduled file move on reboot detected
Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Dynamic (imported) function loading detected
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Installs itself for autorun at Windows startup
Uses suspicious command line tools or Windows utilities

How to determine Spyware.Keydoor?


File Info:
name: CC63F27CADD6DF9FA666.mlwpath: /opt/CAPEv2/storage/binaries/ec3f9ab49cfb788101f7c16e09115ad732169338f9e278743cc26174f4326541crc32: A36F2C2Dmd5: cc63f27cadd6df9fa6666b5c700023d2sha1: ed27906dc370178eb18402b634ce5140a8dfe545sha256: ec3f9ab49cfb788101f7c16e09115ad732169338f9e278743cc26174f4326541sha512: dbb6341b69e372f70a62d8e589c978427d9a0f003bb49c82b91a075186a46b30e01b475ee27649832d26fcfa6fdcbcc2381fc8d071f8a73a51fc7898db5c0eefssdeep: 1536:IE3qz4ayX9ioT5Xl8lQWj1vTo5G6kvBzodfjZw4jk5tGwts1d:179l86WqGzIfjZwik5tE1dtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C1A38D11B881C573C04A95711499E7B2AB3DF9316A79A583F38D0FBA5FB02D0663E387sha3_384: 2bcfa9477c3abfb857e6220d1a3f0e6a99b2e9b3bba55fca970ab1686177d9e7085f4657dc04471ad0dcf5a9502dcb7cep_bytes: e8ea650000e978feffff8bff558bec51timestamp: 2012-07-26 18:49:30
Version Info:
0: [No Data]

Spyware.Keydoor also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37920560
FireEye	Generic.mg.cc63f27cadd6df9f
CAT-QuickHeal	Trojan.Dynamer.8881
McAfee	GenericRXEO-DF!CC63F27CADD6
Cylance	Unsafe
Zillya	Trojan.Katusha.Win32.38343
Sangfor	Worm.Win32.Save.a
K7AntiVirus	Trojan ( 004c47121 )
K7GW	Trojan ( 004c47121 )
Cybereason	malicious.cadd6d
Arcabit	Trojan.Generic.D2429F30
BitDefenderTheta	AI:Packer.DD3671A21F
Cyren	W32/S-0ee6d6bf!Eldorado
Symantec	Backdoor.Waketagat
ESET-NOD32	Win32/Spy.Keydoor.AD
Baidu	Win32.Trojan.Agent.avd
TrendMicro-HouseCall	TSPY_HPURSNIF.SM1
ClamAV	Win.Malware.Scar-9776391-0
Kaspersky	Trojan.Win32.Scar.ojnn
BitDefender	Trojan.GenericKD.37920560
NANO-Antivirus	Trojan.Win32.TrjGen.drufdw
Avast	Win32:BackDoor-AFV [Trj]
Tencent	Trojan.Win32.BitCoinMiner.la
Ad-Aware	Trojan.GenericKD.37920560
Emsisoft	Trojan.GenericKD.37920560 (B)
Comodo	TrojWare.Win32.Agent.XYZ@6l9auh
F-Secure	Trojan.TR/Agent.106509
DrWeb	Trojan.Siggen6.34441
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_HPURSNIF.SM1
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Sophos	ML/PE-A + Troj/Scar-CV
APEX	Malicious
Jiangmin	Trojan/Generic.beovz
MaxSecure	Trojan.Scar.OETR
Avira	TR/Agent.106509
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Generic.ASMalwS.1039187
Microsoft	Backdoor:Win32/Rifdoor.B!bit
ViRobot	Backdoor.Win32.Agent.106526
GData	Win32.Trojan-Spy.Ursnif.K
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Bmbot.C792257
Acronis	suspicious
VBA32	Trojan.Scar
ALYac	Trojan.Agent.Spear16F1
Malwarebytes	Spyware.Keydoor
Ikarus	Trojan.Win32.Agent
Rising	Spyware.Keydoor!1.B6A0 (CLASSIC)
Yandex	Trojan.Agent!v5BuXtqGM7w
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.XFS!tr
AVG	Win32:BackDoor-AFV [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (D)