Should I remove “Trojan.Win64.Donut.gbe”?

The Trojan.Win64.Donut.gbe is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win64.Donut.gbe virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Tries to suspend Cuckoo threads to prevent logging of malicious activity
• Tries to unhook or modify Windows functions monitored by Cuckoo

How to determine Trojan.Win64.Donut.gbe?

File Info:
name: 8F1CD8D17B6EEADF9CA7.mlw
path: /opt/CAPEv2/storage/binaries/475f0a4248b9e80094bde9a2307603df79045bb00c158b8ab77090f686df932c
crc32: BFCC315B
md5: 8f1cd8d17b6eeadf9ca7b13354c85a4e
sha1: 841b4f7b52db4143c763e6c7b68834a1594f03e5
sha256: 475f0a4248b9e80094bde9a2307603df79045bb00c158b8ab77090f686df932c
sha512: 6438e1d9f5a510114b73b3554031398a1b12fdc05ea5b7ac5ab349e92af3d5df0071711ed275393349f0322c10de719329f856ae6e010492e07a10ce3d2d61ee
ssdeep: 98304:FAzEtbqjsTd4sr+0asRjExzSbb2T/UfwyFFmdISmB9XmKmB8izf7AbVXOHzPbU5J:CIZqKdBss9Ex4wy33B10zmsvIy0y
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1676622FE21543368C41AC5385837ED05B2F6551E0EEADAFD72EA7A903BAF815CA01F05
sha3_384: 1885d8f557d71fcf8e47fdc409b7f57fe8a294b93af200f11da98465acb7ddc787ce127b2678d21aef1e7d32de4a6042
ep_bytes: 680c7eac5de85ec33600f79d1c433a58
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan.Win64.Donut.gbe also known as:

How to remove Trojan.Win64.Donut.gbe?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.