About “Trojan.Downloader.JRBE (B)” infection

The Trojan.Downloader.JRBE (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Downloader.JRBE (B) virus can do?

• Sample contains Overlay data
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial language used in binary resources: Arabic (Saudi Arabia)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan.Downloader.JRBE (B)?

File Info:
name: F667F1B4464D1F3B00DC.mlw
path: /opt/CAPEv2/storage/binaries/df04f6e37a64c094bb6a8c82ca009c3e27883df339f285d4ffc6ff5757ee8435
crc32: 36FC2533
md5: f667f1b4464d1f3b00dcf579139f303a
sha1: 668daf7a675e47e085d51021f35d76298c992c45
sha256: df04f6e37a64c094bb6a8c82ca009c3e27883df339f285d4ffc6ff5757ee8435
sha512: 5d1629afafd66b3e9821cb81ddbbedeaac7119194de1e0b50fdc2a7336f0b51afd145d31ad2d264f3c5ec4f969045072aebb37a6d87a91b2c187b18fe8263b3b
ssdeep: 6144:GKF8AITGwgHF2BltbdyPUVn1/PRN2kIHVtSu:9F81yPyZVnnqou
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15484D0658BC15EF0E3ABA9F904F6D985B135FC2060D24A8E8F463BDD4E723809468DDD
sha3_384: 408a6b7dc024f277a440d85ce4c07cf4d40c2245bfe12b99f688393b1cf474ee9a5c1f4f66e7711165bb72f4e6853d0d
ep_bytes: 57565351e927a00000c3cccccccccccc
timestamp: 2014-08-28 22:51:35

Version Info:
CompanyName: Buik
FileDescription: Buik proged
FileVersion: Version 2.1.1
InternalName: Buik
LegalCopyright: Copyright by Nego© 
OriginalFilename: Buik
Translation: 0x0409 0x04e3

Trojan.Downloader.JRBE (B) also known as:

How to remove Trojan.Downloader.JRBE (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.