Malware

PWS:Win32/Stealer.V!MTB removal instruction

Malware Removal

The PWS:Win32/Stealer.V!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What PWS:Win32/Stealer.V!MTB virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • Enumerates running processes
  • Expresses interest in specific running processes
  • CAPE extracted potentially suspicious content
  • Unconventionial binary language: Tamil
  • Unconventionial language used in binary resources: Polish
  • Authenticode signature is invalid
  • Creates a hidden or system file
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Accessed credential storage registry keys
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

How to determine PWS:Win32/Stealer.V!MTB?


File Info:

name: A3C70C4064893A1F19E8.mlw
path: /opt/CAPEv2/storage/binaries/a1b479d8869b00494d1f520af59bbce68da085ad78a6def03a96082b1963a5dc
crc32: 1F1DF4C1
md5: a3c70c4064893a1f19e8039bb8ca4ccc
sha1: 44e973a4503452b426c0d89003aa19a0258eb9db
sha256: a1b479d8869b00494d1f520af59bbce68da085ad78a6def03a96082b1963a5dc
sha512: 068fe6c1536bdb7a98838823510935fb7f80c549e4c93adc842aa79aa4b66148e4c99358cac9c7d7258bb92e09c46239d91e6c4f119d86bf6d45ff255b76840a
ssdeep: 98304:YFOACSlv2nyt+9vgQ01+sHZPOv5nnCBNGN+6vXGb3uv3PBTB6xaYWpN9BabJYjfb:YvzgnUmR01+sHZP8nnCB4XGE/BTBBYWf
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13846234A20E14530F4A3933B55B7AAA0493D7F325FF675AE7BC47A8DD534840AB36B02
sha3_384: 232d05b39f0e322f1d39e45c38c934acc3d5e748d10d6538d21df6976c1560662633f0a647aeb3a6e76df8c61f588ac9
ep_bytes: e858440000e9000000006a1468f8fc42
timestamp: 2018-10-04 14:34:33

Version Info:

FileVersion: 1.0.0.1
Translation: 0x0449 0x04b1

PWS:Win32/Stealer.V!MTB also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.NeutrinoPOS.4!c
tehtrisGeneric.Malware
CAT-QuickHealTrojanPWS.Stealer
McAfeeSodinokibi!A3C70C406489
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0054f6171 )
AlibabaTrojanPSW:Win32/Stealer.1ccdd73e
K7GWTrojan ( 0054f6171 )
CrowdStrikewin/malicious_confidence_100% (D)
ArcabitTrojan.Brsecmon.1
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Kryptik.GTPB
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyTrojan-Banker.Win32.NeutrinoPOS.ebp
BitDefenderTrojan.Brsecmon.1
NANO-AntivirusTrojan.Win32.NeutrinoPOS.fqvzgh
MicroWorld-eScanTrojan.Brsecmon.1
RisingTrojan.Generic@AI.92 (RDML:EBaD0XK/fyN5SuWyQQ0z9w)
Ad-AwareTrojan.Brsecmon.1
EmsisoftTrojan.Brsecmon.1 (B)
F-SecureHeuristic.HEUR/AGEN.1209693
DrWebTrojan.Encoder.3953
BitDefenderThetaGen:NN.ZexaF.34742.@B0@aOdWeGkG
TrendMicroTrojan.Win32.SODINOK.SM.hp
McAfee-GW-EditionBehavesLike.Win32.Generic.th
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.a3c70c4064893a1f
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Banker.NeutrinoPOS.kg
AviraHEUR/AGEN.1209693
MAXmalware (ai score=100)
MicrosoftPWS:Win32/Stealer.V!MTB
ZoneAlarmTrojan-Banker.Win32.NeutrinoPOS.ebp
GDataTrojan.Brsecmon.1
AhnLab-V3Win-Trojan/MalPe10.Suspicious.X1959
VBA32BScope.TrojanBanker.NeutrinoPOS
ALYacTrojan.Brsecmon.1
MalwarebytesTrojan.MalPack.GS
PandaTrj/GdSda.A
TrendMicro-HouseCallTrojan.Win32.SODINOK.SM.hp
TencentWin32.Trojan-banker.Neutrinopos.Lned
YandexTrojan.PWS.NeutrinoPOS!gwYAyPawMv8
IkarusTrojan-Ransom.Sodinokibi
MaxSecureRansomeware.CRAB.gen
FortinetW32/GenKryptik.DJRS!tr
AVGWin32:TrojanX-gen [Trj]
Cybereasonmalicious.064893
AvastWin32:TrojanX-gen [Trj]

How to remove PWS:Win32/Stealer.V!MTB?

PWS:Win32/Stealer.V!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment