Should I remove “Trojan.Win32.VBKrypt.xabo”?

The Trojan.Win32.VBKrypt.xabo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.VBKrypt.xabo virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Albanian
• The binary contains an unknown PE section name indicative of packing
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan.Win32.VBKrypt.xabo?

File Info:
name: BD628BF677C510CC4F53.mlw
path: /opt/CAPEv2/storage/binaries/5fd226400a95f330fdee18fb38e84f419b9233289a10ba0b07b6c3a87a106aa0
crc32: 8A7ABC4A
md5: bd628bf677c510cc4f5362ab79545320
sha1: c942c805692a8e50bb8c85a11aecf3f19d59e707
sha256: 5fd226400a95f330fdee18fb38e84f419b9233289a10ba0b07b6c3a87a106aa0
sha512: 08fd183ea65ac1ddca8948d9467fddaafd4caac9d0de7f16fd630b46cffe16e09575301c0082b5abce5110259c64480086614ed388f6fb3e504232c72c8e2c1a
ssdeep: 3072:W6Ccn27mUC7AdYzrV+Dljy/32ubwZZqJ:W6Ccn2xCkdYzrVolu/J0ZZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T130A3F141BF34D2ABD73D577AC6322EB696A27C96A966D0CCE7F836CF4470110C05E84A
sha3_384: 363e90d10c6170113b208828d6d85e510d1cd5b894287cbf0a0936971c34780d94da832ef3092860ad444750d08680bf
ep_bytes: 60be002042008dbe00f0fdff57eb0b90
timestamp: 2012-05-21 22:42:06

Version Info:
Translation: 0x0409 0x04b0
Comments: Devoto qs medico
CompanyName: attuo tn
FileDescription: Tronco jp false mance
LegalCopyright: cesoia sbendo gm
LegalTrademarks: sicure ah
ProductName: piango
FileVersion: 5.05.0008
ProductVersion: 5.05.0008
InternalName: alta
OriginalFilename: alta.exe

Trojan.Win32.VBKrypt.xabo also known as:

How to remove Trojan.Win32.VBKrypt.xabo?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.