Trojan.PackedENT removal

The Trojan.PackedENT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Trojan.PackedENT virus can do?

• Executable code extraction
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Mimics the system’s user agent string for its own requests
• A process attempted to delay the analysis task.
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Attempts to remove evidence of file being downloaded from the Internet
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Installs itself for autorun at Windows startup
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Trojan.PackedENT?

File Info:
crc32: 33C9EFC3md5: 77bc8115f6b1aa37a4554f9a5b4fb35bname: 34u8ep_0936391.exesha1: c89ee68c057b129eca261c6f2ffbec73f7eb4beasha256: 6aa3278cc8482929434e8d53e4277d443d477698871f08b5e05095a88289a989sha512: 6121600cabcb6499fa059f1a1ee6c711bb5cd2da127493d9cc1a185d095de8768ec8191ba73425e4d919ce45051e857f0c31bb9182210540fd69cb5cc5b63600ssdeep: 3072:8/xnsruUBlyNEX2DO3KX13Q613rXYFAqBEUg:8/lsruU77Xd3m135LqAqWUgtype: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Version Info:
0: [No Data]

Trojan.PackedENT also known as:

DrWeb	Trojan.DownLoader30.36539
MicroWorld-eScan	Trojan.GenericKD.41996119
FireEye	Generic.mg.77bc8115f6b1aa37
CAT-QuickHeal	Trojan.Multi
McAfee	RDN/Emotet-Dropped
Malwarebytes	Trojan.Emotet
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.41996119
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.c057b1
TrendMicro	TROJ_GEN.R04AC0DK919
BitDefenderTheta	Gen:NN.ZexaF.32250.jGX@aq7dsCki
F-Prot	W32/Trojan2.QAKT
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:Malware-gen
GData	Trojan.GenericKD.41996119
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.pef
Alibaba	Trojan:Win32/Emotet.30928a68
AegisLab	Trojan.Win32.Emotet.L!c
Rising	Trojan.Generic@ML.86 (RDML:/CwqgjPnWKzbRz/UnaAyEQ)
Endgame	malicious (high confidence)
Sophos	Mal/EncPk-APC
F-Secure	Trojan.TR/AD.Emotet.eginz
Zillya	Trojan.Emotet.Win32.18628
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.ch
Ikarus	Trojan-Banker.Emotet
Cyren	W32/Trojan.VEWW-3146
Jiangmin	Trojan.Banker.Emotet.mdx
Avira	TR/AD.Emotet.eginz
Antiy-AVL	Trojan/Win32.Casur
Microsoft	Trojan:Win32/Emotet.BA!MSR
Arcabit	Trojan.Generic.D280CF57
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.pef
AhnLab-V3	Malware/Win32.RL_Generic.R298207
Acronis	suspicious
VBA32	Trojan.PackedENT
ALYac	Trojan.Agent.Emotet
MAX	malware (ai score=86)
Ad-Aware	Trojan.GenericKD.41996119
Cylance	Unsafe
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.GYCR
TrendMicro-HouseCall	TROJ_GEN.R04AC0DK919
Yandex	Trojan.Kryptik!JN1D6B1bb60
SentinelOne	DFI – Suspicious PE
MaxSecure	Trojan.Malware.73767892.susgen
Fortinet	W32/TrickBot.CC!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Trojan.075

How to remove Trojan.PackedENT?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.