Backdoor:Win32/Buhtrap.A!dha

Detected by Microsoft Defender Antivirus

Aliases: No associated aliases

Summary

Microsoft Defender Antivirus detects and removes this threat.

This backdoor can give a malicious hacker unauthorized access and control of your PC. It checks your PC for processes, folders, and browsing history related to applications used internally by banks. It then connects to a command-and-control (C&C) server to send information and also to download additional malware.

It employs social engineering to infect computers. It pretends to be an installer or an update for certain popular applications.

Find out ways that malware can get on your PC.

Use the following free Microsoft software to detect and remove this threat:

Microsoft Defender Antivirus for Windows 8 and Windows 10, or Microsoft Security Essentials for Windows 7 and Windows Vista
Microsoft Safety Scanner

You should also run a full scan. A full scan might find hidden malware.

Use cloud protection

Use cloud protection to help guard against the latest malware threats. It’s turned on by default for Microsoft Security Essentials and Windows Defender for Windows 10.

Go to All settings > Update & security > Windows Defender and make sure that your Cloud-based Protection settings is turned On.

Get more help

You can also see our advanced troubleshooting page for more help or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

_ClientBank.exe	CliBank.exe	GPBClient.exe	productprototype.exe
_ftcgpk.exe	CliBankOnlineEn.exe	GpbClientSftcws.exe	quickpay.exe
ADirect.exe	CliBankOnlineRu.exe	ibconsole.exe	rclaunch.exe
ant.exe	CliBankOnlineUa.exe	IbcRemote31.exe	rclient.exe
arm.exe	client.exe	icb_c.exe	retail.exe
arm_mt.exe	client2.exe	ICLTransportSystem.exe	retail32.exe
ARMSH95.EXE	Client2008.exe	IMBLink32.exe	RkcLoader.exe
asbank_lite.exe	Client32.exe	intpro.exe	rmclient.exe
bank.exe	client6.exe	ip-client.exe	Run.exe
bank32.exe	clientbk.exe	iscc.exe	saclient.exe
BankCl.exe	CLMAIN.exe	ISClient.exe	scardsvr.exe
Bankline.EXE	clntstr.exe	kabinet.exe	SGBClient.ex
bbclient.exe	clntw32.exe	kb_cli.exe	SGBClient.exe
bbms.exe	cncclient.exe	KLBS.exe	srcbclient.exe
bc.exe	contactng.exe	KlientBnk.exe	SRCLBClient.exe
BC_Loader.exe	Core.exe	lfcpaymentais.exe	SrCLBStart.exe
BClient.exe	cshell.exe	loadmain.exe	sx_Doc_ni.exe
bk.exe	cws.exe	lpbos.exe	translink.exe
BK_KW32.EXE	cyberterm.exe	mebiusbankxp.exe	twawebclient.exe
bnk.exe	dsstart.exe	mmbank.exe	unistream.exe
CB.exe	dtpaydesk.exe	MWClient32.exe	UpMaster.exe
cb193w.exe	eelclnt.exe	ONCBCLI.exe	Upp_4.exe
cbank.exe	el_cli.exe	pcbank.exe	uralprom.exe
cbmain.ex	elbank.exe	pinpayr.exe	vegaClient.exe
CbShell.exe	etprops.exe	Pionner.exe	w32mkde.exe
cbsmain.dll	eTSrv.exe	pkimonitor.exe	wclnt.exe
CBSMAIN.exe	EximClient.exe	pmodule.exe	wfinist.exe
CL_1070002.exe	fcclient.exe	pn.exe	winpost.exe
clb.exe	FColseOW.exe	postmove.exe	wupostagent.exe
CLBANK.EXE	GeminiClientStation.exe	prclient.exe	Zvit1DF.exe
CLBank3.exe

Backdoor:Win32/Buhtrap.A!dha

Summary

What to do now

Use cloud protection

Get more help

Technical information

Threat behavior

Arrival and Installation

Payload

Prevention

Symptoms