Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Backdoor
Threat report

Win32.Backdoor.Agent.A removal tips

Published Apr 15, 2024 Backdoor category 3 min read
Report context

What to verify before removal

Win32.Backdoor.Agent.A removal tips deserves a credential-safety review because this backdoor label can overlap with remote access, browser data theft, or persistence after reboot. Cleanup should include scanning the file, removing the persistence point, and rotating exposed passwords from a clean device.

Start by comparing the local file name with 14F42E022F2494FFC40E.mlw, then review the behavior notes for credential theft, browser data access, remote-control activity, and persistence after reboot. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
14F42E022F2494FFC40E.mlw
  • Compare the suspicious file name with 14F42E022F2494FFC40E.mlw.
  • Confirm the detection name matches Win32.Backdoor.Agent.A removal tips before removing related files.
  • Review the report for credential theft, browser data access, remote-control activity, and persistence after reboot so the cleanup is based on observed behavior, not only the label.
  • After cleanup, rotate passwords from a clean device and review browser sessions or saved credentials.

The Win32.Backdoor.Agent.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Win32.Backdoor.Agent.A virus can do?

  • Sample contains Overlay data
  • HTTPS urls from behavior.
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Behavioural detection: Injection (Process Hollowing)
  • Behavioural detection: Injection (inter-process)
  • Behavioural detection: Injection with CreateRemoteThread in a remote process
  • CAPE detected the embedded win api malware family
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Deletes executed files from disk
  • Anomalous binary characteristics
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Win32.Backdoor.Agent.A?



File Info:

name: 14F42E022F2494FFC40E.mlw
path: /opt/CAPEv2/storage/binaries/c5eb9f3566385e4b3d060256d8e0eb1d9d2ee4b1a3b9c6c9fca0808eea858b3d
crc32: 9E945980
md5: 14f42e022f2494ffc40e5a420939add9
sha1: 92aedca81f12dfa9079e415f166639e70d211fab
sha256: c5eb9f3566385e4b3d060256d8e0eb1d9d2ee4b1a3b9c6c9fca0808eea858b3d
sha512: d1688aacbc27cc3148fc192debbbaf4b9a19e98d58874d0cd89d0ad671be56fcc441ac0a002020fd83ee9a112d9c70beea736aff5179d928fe066d7282cbac19
ssdeep: 12288:jHmznO3n+LPVTv2aM/lNY1NBfL670MuBMRrJbApXXE3:jHz3OTVTfL670MCMXGk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T185F4E016A5A2E085E43D06B4E95686F872041ED17FCA1FB39A91FF9E3F315F05C210AE
sha3_384: 605e9b38a339512644db2119a3dfdd30aebec1a84d5eb2c59371ec9d7226bfe366d77b3504ba7d9eec41ba029514986e
ep_bytes: 558bec83ec088d45fc506a006a006820
timestamp: 2008-08-29 13:01:43


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Organization Chart Add-in for Microsoft Office programs
FileVersion: 15.0.4569.1506
InternalName: OrgChart
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename: OrgChart.Exe
ProductName: Microsoft Office 2013
ProductVersion: 15.0.4569.1506
Translation: 0x0000 0x04e4

Win32.Backdoor.Agent.A also known as:

Bkav W32.AIDetectMalware
DrWeb BackDoor.Siggen.46270
MicroWorld-eScan Win32.Backdoor.Agent.A
FireEye Generic.mg.14f42e022f2494ff
Skyhigh BackDoor-DSE.b
McAfee BackDoor-DSE.b
Malwarebytes Generic.Malware.AI.DDS
VIPRE Win32.Backdoor.Agent.A
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Worm:Win32/Botgor.b90a3be7
K7GW Trojan ( f10005021 )
K7AntiVirus Trojan ( f10005021 )
BitDefenderTheta AI:FileInfector.A44F3C4816
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Botgor
APEX Malicious
TrendMicro-HouseCall BKDR_BOTGOR.SML
ClamAV Win.Malware.Botgor-9853222-0
Kaspersky Worm.Win32.Burn.b
BitDefender Win32.Backdoor.Agent.A
NANO-Antivirus Trojan.Win32.Generic.wdwvx
Avast Win32:Agent-ADAU [Trj]
Tencent Worm.Win32.Burn.a
Emsisoft Win32.Backdoor.Agent.A (B)
Google Detected
F-Secure Trojan.TR/Dropper.Gen
Zillya Worm.Burn.Win32.424
TrendMicro BKDR_BOTGOR.SML
Trapmine malicious.high.ml.score
Sophos W32/Burn-Gen
SentinelOne Static AI – Malicious PE
Jiangmin Backdoor/Agent.bfic
Varist W32/Heuristic-114!Eldorado
Avira TR/Dropper.Gen
MAX malware (ai score=88)
Antiy-AVL Worm/Win32.Burn
Kingsoft malware.kb.a.1000
Microsoft Backdoor:Win32/Botgor.B
Gridinsoft Trojan.Win32.Agent.sa
Xcitium Backdoor.Win32.Agent.~APQ@4ud5h
Arcabit Win32.Backdoor.Agent.A
ZoneAlarm Worm.Win32.Burn.b
GData Win32.Trojan.Botgor.A
Cynet Malicious (score: 100)
VBA32 BScope.Backdoor.Botgor
ALYac Win32.Backdoor.Agent.A
Cylance unsafe
Panda W32/BotNet.K
Rising Virus.Botgor!1.D115 (CLASSIC)
Yandex Trojan.GenAsa!D907akwlPeY
Ikarus BehavesLike.Win32.ProcessHijack
MaxSecure Trojan.Malware.121218.susgen
Fortinet W32/Botgor.A
AVG Win32:Agent-ADAU [Trj]
DeepInstinct MALICIOUS
alibabacloud Trojan:Win/Botgor.A(dyn)

How to remove Win32.Backdoor.Agent.A?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.