Categories: Malware

Win32/Surubat.E information

The Win32/Surubat.E is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Surubat.E virus can do?

At least one process apparently crashed during execution
SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
A process created a hidden window
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Creates a copy of itself
Attempts to modify Explorer settings to prevent file extensions from being displayed
Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Win32/Surubat.E?


File Info:
name: 6A6FA89DC570D05FD8E2.mlwpath: /opt/CAPEv2/storage/binaries/a022f12a198bc52b2784305c3cf5857bfadd8a6ebae446c46f43110dbcd99eb5crc32: 499B115Emd5: 6a6fa89dc570d05fd8e2ce7f61370b5dsha1: 401881d4ea2d940698499db4000d46a41a34adddsha256: a022f12a198bc52b2784305c3cf5857bfadd8a6ebae446c46f43110dbcd99eb5sha512: c7af719a0b3e2b5eb2bb0e4770cdd296112102c02a6877325a25495bf92064fa970e8d0de33923bbbb76f3e50614d1f5a3c0f3a80cad32756325698360936e10ssdeep: 1536:pGjuLYP4cdsD+ECZVp8YO3333333333333333lhhhhhhhhPQVgd54vve:pGCLDksD+XZVpshhhhhhhhPL7Eetype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B9943B01B366DAC4DC195932D4030BBAE7F21C25A06E6B271471FE1F7E75158AF2A23Bsha3_384: 1f8c9abe685efc30e6ac6b8dbf5cd5e20a7ade4c62f4ff5619ed007b474c8df1fed93cf9bbe467a316ccb8b1d3eaebd7ep_bytes: 558bec6aff68f8964000680c83400064timestamp: 2006-08-10 12:16:57
Version Info:
Comments: CompanyName: FileDescription: FileVersion: InternalName: LegalCopyright: LegalTrademarks: OriginalFilename: PrivateBuild: ProductName: ProductVersion: SpecialBuild: Translation: 0x0409 0x04b0

Win32/Surubat.E also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.IRCBot.tqVG
Elastic	malicious (high confidence)
DrWeb	BackDoor.IRC.Sdbot.18291
MicroWorld-eScan	Trojan.GenericKD.38160905
FireEye	Generic.mg.6a6fa89dc570d05f
CAT-QuickHeal	Trojan.Mauvaise.SL1
ALYac	Trojan.GenericKD.38160905
Cylance	Unsafe
Zillya	Worm.Surubat.Win32.90
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0058afa31 )
Alibaba	Backdoor:Win32/IRCBot.271
K7GW	Trojan ( 0058afa31 )
Cybereason	malicious.dc570d
BitDefenderTheta	Gen:NN.ZexaF.34084.zq0@aKfPYfji
Cyren	W32/Trojan.ALUK-5132
Symantec	W32.IRCBot
ESET-NOD32	a variant of Win32/Surubat.E
TrendMicro-HouseCall	Backdoor.Win32.IRCBOT.SMDA1
Paloalto	generic.ml
ClamAV	Win.Trojan.Generic-9907673-0
Kaspersky	HEUR:Trojan.Win32.Reconyc.gen
BitDefender	Trojan.GenericKD.38160905
NANO-Antivirus	Trojan.Win32.IRCBot.gjpmrd
Avast	Win32:IRCBot-ANZ [Trj]
Tencent	Backdoor.Win32.Ircbot.qz
Ad-Aware	Trojan.GenericKD.38160905
Emsisoft	Trojan.GenericKD.38160905 (B)
Comodo	Backdoor.Win32.IRCBot.~31199@fayok
TrendMicro	Backdoor.Win32.IRCBOT.SMDA1
Sophos	Mal/Generic-R + Mal/Behav-043
GData	Win32.Worm.Surubat.A
Jiangmin	Backdoor.IRCBot.rh
MaxSecure	Trojan.Malware.121218.susgen
Avira	BDS/Agent.193537
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Generic.ASMalwS.2550C1
Gridinsoft	Ransom.Win32.Gen.sa
Arcabit	Trojan.Generic.D2464A09
ViRobot	Backdoor.Win32.Z.Ircbot.424448
Microsoft	Backdoor:Win32/IRCbot
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.RL_IRCBot.R283521
Acronis	suspicious
McAfee	GenericRXAA-AA!6A6FA89DC570
TACHYON	Trojan/W32.Reconyc.424448.B
VBA32	Win32.Trojan.Dropper.Heur
Malwarebytes	Backdoor.IRCBot
APEX	Malicious
Rising	Backdoor.IRCbot.vtu (CLASSIC)
Yandex	Trojan.GenAsa!f4gGPUaRfME
Ikarus	Backdoor.Agent
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/Surubat.A!worm
AVG	Win32:IRCBot-ANZ [Trj]
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_100% (W)