What is “Trojan.Rajbot.Gen.1”?

The Trojan.Rajbot.Gen.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Rajbot.Gen.1 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to repeatedly call a single API many times in order to delay analysis time
• CAPE detected the NetWire malware family
• Creates known CypherIT/Frenchy Shellcode mutexes
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.Rajbot.Gen.1?

File Info:
name: DB3AD4C491C1DEDB58C1.mlw
path: /opt/CAPEv2/storage/binaries/cb07cbaad5fff66a6f58c43dfc24ad56d9a8fcd7f64332d744d941c5fb8c679d
crc32: 7B382014
md5: db3ad4c491c1dedb58c11e9814479929
sha1: c64961aa95bf58d57e610046ae71c9fc62131a42
sha256: cb07cbaad5fff66a6f58c43dfc24ad56d9a8fcd7f64332d744d941c5fb8c679d
sha512: 90f89a7b4de517208e789794a7bc61573eb731a6124be0c64c9854aaa7da4fa40bd93c28d4b149ce2f3e68fabcb722c9136a4c258203cd0c00399c7d4df44ff0
ssdeep: 98304:K2cPK8Qh71GAnlUxvawmWybJQAlbM0azCWtg04c5bz:lCKhhZGHCwBx2bazjtf5bz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1792612037345D121FFAB55B3979EB20147B86C630233861F63883D7969702B2AF6D7A6
sha3_384: 234367da04f69d4520e6142a912b7a62061bc3b0cb1a1eb8e90fd99965c976a73c30e316e15bda3e824b008f50bff6e6
ep_bytes: e8c8d00000e97ffeffffcccccccccccc
timestamp: 2019-06-03 21:31:01

Version Info:
Translation: 0x0809 0x04b0

Trojan.Rajbot.Gen.1 also known as:

How to remove Trojan.Rajbot.Gen.1?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.