Trojan.Jobutyve (file analysis)

The Trojan.Jobutyve is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Jobutyve virus can do?

• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• Drops a binary and executes it
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Deletes executed files from disk
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.Jobutyve?

File Info:
name: 285AC9763918EFD48D66.mlw
path: /opt/CAPEv2/storage/binaries/02d05ed6ba838fba1890289294b0da7ab8e44a557af9293efc7668bdea0ba80d
crc32: B8003E38
md5: 285ac9763918efd48d665642c8305347
sha1: 9e0bc78def71329e7e508fde324b1e2dc99d9565
sha256: 02d05ed6ba838fba1890289294b0da7ab8e44a557af9293efc7668bdea0ba80d
sha512: 0e60631c244940cc38ab6b2ed07916312e6bda65c205ea3074b5caff1231428f88c1164b117674ff88cde7ce864c1b875fcc30a38937d43b38493ac00a611a2c
ssdeep: 196608:D1EDyWW9fcVPeIsXHyVOJefKyRSgU00aZfE:D1+V4wds3p2/z0z
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1389633647EC6C6FACBA145B08491D7FC556A2E10660125CBB7243C0BBA573D2E23DBE3
sha3_384: 258c5f6ac82a782db2ff33700d1daf447bd125c49a45b61c8b87c3d29d0bb6a59ae038a0094b20d6d8f9aea9bd8a5cc1
ep_bytes: 558bec6aff6878c84100684095410064
timestamp: 2016-04-02 22:14:00

Version Info:
CompanyName: rsloadNET + Wampir
FileDescription: ThinApp - Создание портативных программ
FileVersion: 5.2.8.16758
InternalName: ThinApp;ThinAppPortable;VMware ThinApp;;VMware ThinApp;ThinApp
LegalCopyright: System
OriginalFilename: ThinApp 5.2.8.16758.exe;desc;2021.04.17 23:42:35
PrivateBuild: 1D680840-D7DA-11DD-9F32-9C5C8EBED652
ProductName: Addon for Total Commander PowerUser
ProductVersion: 5.2.8.16758
Translation: 0x0000 0x04b0

Trojan.Jobutyve also known as:

How to remove Trojan.Jobutyve?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.