Backdoor.MSIL.Agent.SKA

The detection of Backdoor.MSIL.Agent.SKA on your system indicates a potential security threat that requires immediate attention. This detection name suggests a backdoor threat, which is a type of malware that allows unauthorized access to a computer system. In this report, we will provide an overview of what Backdoor.MSIL.Agent.SKA is, how it operates, its symptoms, and most importantly, the steps you can take to remove it from your system.

What Is Backdoor.MSIL.Agent.SKA?

Backdoor.MSIL.Agent.SKA is identified as a backdoor threat, which means it is designed to bypass normal security mechanisms to allow unauthorized access to a computer. Backdoors like this can be used to steal sensitive information, install additional malware, or provide a pathway for remote control of the infected system. The specifics of how Backdoor.MSIL.Agent.SKA operates can vary, but its primary function is to maintain a covert channel of communication between the infected system and a command and control server operated by the attackers.

How Backdoor.MSIL.Agent.SKA Operates

Backdoor threats like Backdoor.MSIL.Agent.SKA typically operate by first infecting a system through various means such as exploited vulnerabilities, phishing attacks, or infected software downloads. Once inside, they can establish a connection with their command and control servers, awaiting instructions. These instructions can range from stealing local data, capturing keystrokes, to installing additional malicious software. The operation of Backdoor.MSIL.Agent.SKA would likely involve similar tactics, aiming to maintain a persistent presence on the infected system without being detected.

Symptoms of Infection

Symptoms of a Backdoor.MSIL.Agent.SKA infection can be subtle and may not always be immediately apparent. Common indicators of a backdoor infection include unusual network activity, slow system performance, and unexplained changes to system settings or files. In some cases, the presence of a backdoor might only be discovered during a routine security scan or when the malware engages in suspicious activity that triggers security software. It's crucial to be vigilant and monitor system behavior regularly to identify potential threats early.

How to Remove Backdoor.MSIL.Agent.SKA

1. Enter Safe Mode with Networking to limit the malware's ability to interfere with the removal process. This mode allows you to use the internet to download necessary tools while minimizing the risk of the malware spreading or causing further damage.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated with the latest definitions to improve the chances of detecting and removing Backdoor.MSIL.Agent.SKA.
3. Uninstall suspicious programs that you do not recognize or that were installed around the time the malware was detected. Be cautious and only remove programs you are certain are not necessary for your system's operation.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings. This can help remove any malicious extensions or settings that the malware might have installed.
5. After completing the above steps, reboot your system and perform another full scan to ensure that the threat has been fully removed. Repeat the scanning process until no threats are detected to confirm the malware's removal.

Conclusion

The detection and removal of Backdoor.MSIL.Agent.SKA require careful and immediate action to protect your system and data. By understanding the nature of backdoor threats and following the removal steps outlined, you can effectively eliminate this malware from your system. Remember, prevention is key; keeping your operating system, software, and security tools up to date, along with practicing safe computing habits, can significantly reduce the risk of future infections. Always be cautious when clicking on links, opening attachments, or downloading software from the internet to minimize the risk of introducing malware to your system.

Analysis Report

General information

Family Name:	Backdoor.MSIL.Agent.SKA
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 275e8d513e0c0e3322f79b4f3d0f845c SHA1: 37895edd25736607a40b10505daa0567d2f12ca9 SHA256: 4D69EA2B492F97A010D62318A6A4FADF10486D6AD674D3E2A0194E18FE74A0C4 File Size: 298.03 KB, 298026 bytes

MD5: 649706bd6cb6987380861c3e49686e69 SHA1: 942f94287bf358e6b6ef097783a32cdc21efcd18 SHA256: 2A410849BC7DAE199CC527D5AB47A8BAE9F8BACD9216B1B54E8655B7E535C138 File Size: 307.49 KB, 307492 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
File Description	hawaiians
File Version	2.4.7.81
Legal Copyright	hawaiians hawaiians
Original Filename	hors.exe
Product Name	hawaiians 2.4.7.81
Product Version	2.4.7.81

File Traits

• .NET
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\microsoft.web.webview2.core.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\microsoft.web.webview2.core.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\microsoft.web.webview2.winforms.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\microsoft.web.webview2.winforms.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\microsoft.web.webview2.wpf.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\microsoft.web.webview2.wpf.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\purposely.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\purposely.exe	Synchronize,Write Attributes

Show More

c:\users\user\appdata\local\temp\nsmc690.tmp\purposely.exe.config	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\purposely.exe.config	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\webview2loader.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsmc690.tmp\webview2loader.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\drunkard.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\drunkard.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\drunkard.exe.config	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\drunkard.exe.config	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\microsoft.web.webview2.core.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\microsoft.web.webview2.core.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\microsoft.web.webview2.winforms.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\microsoft.web.webview2.winforms.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\microsoft.web.webview2.wpf.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\microsoft.web.webview2.wpf.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\webview2loader.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsqbc80.tmp\webview2loader.dll	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352*1\??\C:\P	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetComputerNameEx GetUserDefaultLocaleName GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection ZwMapViewOfSection
Process Shell Execute	CreateProcess
Syscall Use	ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtCreateEvent ntdll.dll!NtCreateMutant ntdll.dll!NtCreatePrivateNamespace ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateThreadEx Show More ntdll.dll!NtDuplicateObject ntdll.dll!NtEnumerateKey ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcess ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenSection ntdll.dll!NtOpenThreadToken ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDefaultLocale ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryFullAttributesFile ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationJobObject ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadFile ntdll.dll!NtReadRequestData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtResumeThread ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForMultipleObjects ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWriteFile UNKNOWN

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\Users\Uiaahjlt\AppData\Local\Temp\nsqBC80.tmp\Drunkard.exe ""

C:\Users\Uzbqcikh\AppData\Local\Temp\nsmC690.tmp\Purposely.exe ""