Troj/Formbo-BDL (file analysis)

The Troj/Formbo-BDL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Troj/Formbo-BDL virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

How to determine Troj/Formbo-BDL?


File Info:
crc32: DEB1DDD8
md5: 6e54bbe0fe1885c5262b5f1e72640a7b
name: 6E54BBE0FE1885C5262B5F1E72640A7B.mlw
sha1: bd26fadf4a0c34d58c5a58eafc6b53a3b4cd60e2
sha256: ae33000cbdc7cc10a8d86ce07727c8159d66a6707e2a453d996dc61c709de96f
sha512: c57148bc4df9151048646bdaa11ee28c8a3c301980d9aa1008a191e45fc885eaddcc1563d7f4d44a52a29c80ff49a9167e3a5fa36888dc3c9d18725010232e96
ssdeep: 12288:yBGiY6HqFuOqGTJPc5ypHAzYr1A+/j1nhOEAk5oLOmtiK5oZfT:yA6KFu8JPc5ov/j1hAFLO+FoV
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 2010 Snake
Assembly Version: 0.1.7933.10869
InternalName: StaticArrayInitTypeSize.exe
FileVersion: 0.1.0.1
CompanyName: Snake
LegalTrademarks: 
Comments: Disassembles and assembles GMK files.
ProductName: GMK Assembler
ProductVersion: 0.1.0.1
FileDescription: GMK Assembler
OriginalFilename: StaticArrayInitTypeSize.exe

Troj/Formbo-BDL also known as:

Lionic	Trojan.MSIL.Vobfus.4!c
DrWeb	Trojan.Siggen9.48175
ALYac	Trojan.GenericKD.37607911
Cylance	Unsafe
Alibaba	Trojan:MSIL/AgentTesla.1d836c62
Cyren	W32/MSIL_Kryptik.FOY.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/Formbook.AA
Zoner	Trojan.Win32.119485
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.37607911
MicroWorld-eScan	Trojan.GenericKD.37607911
Tencent	Msil.Trojan-qqpass.Qqrob.Wqwy
Ad-Aware	Trojan.GenericKD.37607911
Sophos	Troj/Formbo-BDL
Comodo	TrojWare.Win32.UMal.zmznf@0
McAfee-GW-Edition	BehavesLike.Win32.Trojan.cc
FireEye	Trojan.GenericKD.37607911
Emsisoft	Trojan.Crypt (A)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:MSIL/AgentTesla.RV!MTB
GData	Trojan.GenericKD.37607911
AhnLab-V3	Malware/Win.FCSU.C4639649
McAfee	RDN/Generic.grp
MAX	malware (ai score=84)
TrendMicro-HouseCall	TROJ_FRS.0NA103IL21
Ikarus	Trojan.Inject
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Malicious_Behavior.SB
AVG	Win32:PWSX-gen [Trj]
Paloalto	generic.ml

How to remove Troj/Formbo-BDL?

Troj/Formbo-BDL removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X