Trojan

Trojan.Win64.Donut.fbr removal guide

Malware Removal

The Trojan.Win64.Donut.fbr is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan.Win64.Donut.fbr virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Possible date expiration check, exits too soon after checking local time
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • A process created a hidden window
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan.Win64.Donut.fbr?



File Info:

name: 955D70E9663D4E84AAEE.mlw
path: /opt/CAPEv2/storage/binaries/11799a402c4d9214f028ea725cf40016e450352fed6977c5bea97df61bcf9d62
crc32: 5D551F4A
md5: 955d70e9663d4e84aaee72a478d1ddb4
sha1: 2ddc92b082c71c48228b3ca5ceb89b1484d38031
sha256: 11799a402c4d9214f028ea725cf40016e450352fed6977c5bea97df61bcf9d62
sha512: d09b35059ee51ba7a18b4bb79b475b5615551a0f618041e9e6e29212d2798fa66f8bac0bbe8b3f9ed1cbeccaabd049e07a743e03d7ea1eea1e1a7b1fc2b801b2
ssdeep: 49152:vZ/nUeT0/hu+fbV3gf/9U58qcZioYo3ZXKDNyD:ezbVwX6mjF3RKDN
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1839533826CB8454BE7BB63B2E23496CF7460A3B75E00D3639AD14D3C6114839BFA4637
sha3_384: 939d4ef77318c55aab0da7e476f19cafed38e89d0fd3ed4f58ab84b9eb8c1acf66189bf55a34bae4ac8acf524f80472c
ep_bytes: 554889e54881ec4000000048b8040000
timestamp: 1970-01-01 00:00:00


Version Info:

CompanyName: Google Inc.
FileTitle: chrome.exe
FileDescription: Google Chrome
FileVersion: 70,0,3538,110
LegalCopyright: Copyright 2017 Google Inc. All rights reserved.
LegalTrademark: 
ProductName: Google Chrome
ProductVersion: 70,0,3538,110
Translation: 0x0409 0x04b0

Trojan.Win64.Donut.fbr also known as:

LionicTrojan.Win32.Inject.4!c
Elasticmalicious (high confidence)
DrWebTrojan.InjectNET.14
MicroWorld-eScanTrojan.GenericKDZ.78844
FireEyeGeneric.mg.955d70e9663d4e84
McAfeeTrojan-FUCP!955D70E9663D
CylanceUnsafe
SangforTrojan.Win64.Donut.fbr
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojan:Win64/Donut.04406c0e
K7GWTrojan ( 00588c581 )
K7AntiVirusTrojan ( 00588c581 )
CyrenW64/Agent.DMU.gen!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win64/Agent.AVO
TrendMicro-HouseCallTROJ_GEN.R002C0DKH21
Paloaltogeneric.ml
KasperskyTrojan.Win64.Donut.fbr
BitDefenderTrojan.GenericKDZ.78844
AvastWin64:Evo-gen [Susp]
TencentMalware.Win32.Gencirc.10cf73a4
Ad-AwareTrojan.GenericKDZ.78844
EmsisoftTrojan.Agent (A)
ComodoTrojWare.Win32.UMal.dvbvx@0
ZillyaTrojan.Donut.Win64.770
TrendMicroTROJ_GEN.R002C0DKH21
McAfee-GW-EditionTrojan-FUCP!955D70E9663D
SophosMal/Generic-S
IkarusTrojan.Win64.Agent
GDataTrojan.GenericKDZ.78844
JiangminTrojan.Donut.jq
MaxSecureTrojan.Malware.128090213.susgen
AviraHEUR/AGEN.1145587
Antiy-AVLTrojan/Generic.ASMalwS.34C0FDD
KingsoftWin32.Troj.Generic_a.a.(kcloud)
GridinsoftTrojan.Win64.Agent.oa!s1
ViRobotTrojan.Win32.Z.Agent.2043392.AI
MicrosoftTrojan:Win64/Donut.CIK!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.R444976
VBA32Trojan.Inject
ALYacTrojan.GenericKDZ.78844
MAXmalware (ai score=82)
MalwarebytesTrojan.Agent
YandexTrojan.Agent!KH9qM8CQz7w
eGambitUnsafe.AI_Score_99%
FortinetW64/Agent.AVO!tr
WebrootW32.Trojan.Gen
AVGWin64:Evo-gen [Susp]
Cybereasonmalicious.082c71
PandaTrj/CI.A

How to remove Trojan.Win64.Donut.fbr?

Trojan.Win64.Donut.fbr removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment