Trojan.Win32.PowerShell.fgb malicious file

The Trojan.Win32.PowerShell.fgb is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.PowerShell.fgb virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities for basic functionality
• Uses Windows utilities to create a scheduled task
• Attempts to modify Windows Defender using PowerShell

How to determine Trojan.Win32.PowerShell.fgb?

File Info:
name: 314320FF1B46E5DB8D2F.mlw
path: /opt/CAPEv2/storage/binaries/471edea18c46b5357db0e54b3b3eaafe43856fa8ffc140efde5b595dc9e03a6f
crc32: 401C40BC
md5: 314320ff1b46e5db8d2f86e244af3b37
sha1: e3c27aa7d4fc5a7b91467184e94de6a727f579e4
sha256: 471edea18c46b5357db0e54b3b3eaafe43856fa8ffc140efde5b595dc9e03a6f
sha512: 3a4affc3180c2a03fa59c2efcfb751c4186a903388aac3046f8d45af840b08853dfbbeb87756d256f159581dc445d418507e7a97838f85a56917ea7969bb422c
ssdeep: 98304:vXz+3TFL2o+R5l+cxb6v7zUqqEG/sYWPYh+f5Fm3TvltS:fK3TAo+RsUq6/cgVTvvS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16316333A04C04573D5723A781E17D1B6FA3CFA4C2B7655CEBBDD6B29E87B24009192CA
sha3_384: a6cc7bd0211058fcc7883251d1e0b4d600b3a347623c7c85ef9e26932802a06e993cc070ab0857c81f64488879d96732
ep_bytes: 558bec83c4f0b888534200e824f2fdff
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: 
CompanyName: Shattered                                                   
FileDescription: Shattered 0.18 Installation                                 
FileVersion: 0.18                
LegalCopyright: Shattered                                                                                           
Translation: 0x0409 0x04e4

Trojan.Win32.PowerShell.fgb also known as:

How to remove Trojan.Win32.PowerShell.fgb?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.