Malware

Troj/Atbot-B removal guide

Malware Removal

The Troj/Atbot-B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Troj/Atbot-B virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Uses Windows utilities to create a scheduled task
  • Behavioural detection: Injection (Process Hollowing)
  • Behavioural detection: Injection (inter-process)
  • Behavioural detection: Injection with CreateRemoteThread in a remote process
  • Deletes executed files from disk
  • Harvests cookies for information gathering
  • Attempts to interact with an Alternate Data Stream (ADS)
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Troj/Atbot-B?


File Info:

name: 1573450571C365F06947.mlw
path: /opt/CAPEv2/storage/binaries/bbd29a175c3f954ea90552a9e0d18beb6366fd7613d9610c8b75660086128e2c
crc32: 363C5BD0
md5: 1573450571c365f06947839e4b795aee
sha1: 5f4cc123e6d95b4967623d80f2852abaa6eb710d
sha256: bbd29a175c3f954ea90552a9e0d18beb6366fd7613d9610c8b75660086128e2c
sha512: 5545ef5baebece23cd94ce8d8c2b0e59db6a24ebe338a82f7c6af8a416773b5003208343bba0a306cab891836cf85ca7989e326af787e5267ff720238869d7d7
ssdeep: 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4ew:ObCjPKNqQEfsw43qtmVfq4F
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T146C5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
sha3_384: c130ad4f11d819b72908cf48cceb531dafecaf30d69c7e7b632b4cabc63f6a92220fe1679d600730c3564e7ceec56d09
ep_bytes: e837c20000e979feffffcccccccccccc
timestamp: 2010-01-15 16:09:54

Version Info:

Translation: 0x0409 0x04b0
CompanyName: Neil Hodgson neilh@scintilla.org
FileDescription: SciTE - a Scintilla based Text Editor
FileVersion: 1.75
InternalName: SciTE
LegalCopyright: Copyright 1998-2007 by Neil Hodgson
OriginalFilename: SciTE.EXE
ProductName: SciTE
ProductVersion: 1.75

Troj/Atbot-B also known as:

LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.65207131
FireEyeGeneric.mg.1573450571c365f0
McAfeeGenericRXAA-FA!1573450571C3
Cylanceunsafe
SangforVirus.Win32.Save.a
K7AntiVirusTrojan ( 005936091 )
AlibabaTrojan:Win32/autoit.ali2000008
K7GWTrojan ( 005936091 )
Cybereasonmalicious.571c36
VirITTrojan.Win32.AutoIt.GD
CyrenW32/Autoit.JFHF-9022
SymantecML.Attribute.HighConfidence
ESET-NOD32MSIL/Spy.Agent.AGJ
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.Autoit-6996111-0
KasperskyUDS:Trojan.Win32.Generic
BitDefenderTrojan.GenericKD.65207131
AvastWin32:Evo-gen [Trj]
TencentTrojan.Win32.Sabsik.haq
SophosTroj/Atbot-B
F-SecureTrojan.TR/Agent.odipt
DrWebTrojan.Siggen17.49996
VIPRETrojan.GenericKD.65207131
TrendMicroTSPY_ATBOT.SMAR5
McAfee-GW-EditionBehavesLike.Win32.Generic.vm
EmsisoftTrojan.GenericKD.65207131 (B)
IkarusTrojan.MSIL.Spy
GDataTrojan.GenericKD.65207131
JiangminTrojanSpy.MSIL.cvgn
GoogleDetected
AviraTR/Agent.odipt
MAXmalware (ai score=85)
Antiy-AVLTrojan/Autoit.Winmgr.a
ArcabitTrojan.Generic.D3E2FB5B
ZoneAlarmUDS:Trojan.Win32.Generic
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
AhnLab-V3Spyware/Win.Atbot.R531437
Acronissuspicious
VBA32Trojan.Autoit.Obfus
ALYacTrojan.GenericKD.65207131
MalwarebytesBackdoor.Bladabindi
TrendMicro-HouseCallTSPY_ATBOT.SMAR5
RisingTrojan.Obfus/Autoit!1.E083 (CLASSIC)
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetAutoIt/Packed.RN!tr
AVGWin32:Evo-gen [Trj]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Troj/Atbot-B?

Troj/Atbot-B removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment