Categories: Trojan

TrojanDownloader:Win32/Citeary.A!MTB removal guide

The TrojanDownloader:Win32/Citeary.A!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Citeary.A!MTB virus can do?

Uses Windows utilities for basic functionality
Authenticode signature is invalid
Attempts to modify proxy settings
Attempts to disable Windows Defender
Uses suspicious command line tools or Windows utilities
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanDownloader:Win32/Citeary.A!MTB?


File Info:
name: 2B0131E1343D5B215B95.mlwpath: /opt/CAPEv2/storage/binaries/2ab2f178671a9872a59fe9e4e2dfd6d68abd5d9c3f37334d6f91cec9172f1041crc32: E91E72B6md5: 2b0131e1343d5b215b9522ba617b5a70sha1: 216c98ed8603411f40bb107f73e61465972b2e37sha256: 2ab2f178671a9872a59fe9e4e2dfd6d68abd5d9c3f37334d6f91cec9172f1041sha512: c288f60bcf65820f5e34cc7bef26aefdee9bda3aa3c2dce7658d85d8c179b36cc6c986e7fb74045031a1553721412cc9159235aa0bc262e289c1f03c3ebd8d0fssdeep: 1536:Amzt7dACGHQXfuVY04xn+5PuxP7mGhw9N:AmznjlsY04xnQWxmtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13B734B02A77486F2F195017531B5B63B0699383053EF50E3B7F22A771A64AE2753EB0Bsha3_384: 074354f49fa28295fbb1e439b7719c2797927beee38e36cda7c6ae63a125c480438d0ac383473c80a9c3d74340882618ep_bytes: 558bec81ec20020000688a7f00006800timestamp: 2010-08-04 10:29:52
Version Info:
0: [No Data]

TrojanDownloader:Win32/Citeary.A!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.lb6y
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.11044
FireEye	Generic.mg.2b0131e1343d5b21
CAT-QuickHeal	Trojan.Small.BP
Skyhigh	BehavesLike.Win32.Infected.lh
ALYac	Gen:Variant.Doina.11044
Malwarebytes	Generic.Malware.AI.DDS
Zillya	Downloader.Agent.Win32.69855
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 004cbf9f1 )
BitDefender	Gen:Variant.Doina.11044
K7GW	Trojan-Downloader ( 004cbf9f1 )
Cybereason	malicious.d86034
Baidu	Win32.Backdoor.Agent.n
VirIT	Trojan.Win32.DownLoader9.CVYG
Symantec	W32.SillyDC
ESET-NOD32	Win32/TrojanDropper.Agent.SPC
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.KillAV-47
Kaspersky	Trojan-Dropper.Win32.Agent.dcbd
Alibaba	Worm:Win32/Citeary.caac4e0f
NANO-Antivirus	Trojan.Win32.Agent.bqtwe
Rising	Worm.Citeary!1.D87E (CLASSIC)
Emsisoft	Gen:Variant.Doina.11044 (B)
F-Secure	Worm.WORM/Citeary.dou
DrWeb	Trojan.DownLoader9.49978
VIPRE	Gen:Variant.Doina.11044
TrendMicro	TROJ_FAKEAV.SMB1
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE.118BQ95
Jiangmin	TrojanDownloader.Agent.cglw
Webroot	W32.Malware.Downloader
Varist	W32/Citeary.B.gen!Eldorado
Avira	WORM/Citeary.dou
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Dropper]/Win32.Agent.dcbd
Xcitium	TrojWare.Win32.PSW.GamePass.B@2mkvnt
Arcabit	Trojan.Doina.D2B24
SUPERAntiSpyware	Trojan.Agent/Gen-Dropper
ZoneAlarm	Trojan-Dropper.Win32.Agent.dcbd
Microsoft	TrojanDownloader:Win32/Citeary.A!MTB
Google	Detected
AhnLab-V3	Trojan/Win32.Agent.R125686
Acronis	suspicious
VBA32	BScope.Trojan.Agent
DeepInstinct	MALICIOUS
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_FAKEAV.SMB1
Tencent	Trojan-Dropper.Win32.Agent.zbf
Ikarus	Worm.Win32.Citeary
MaxSecure	Trojan.Malware.1627147.susgen
Fortinet	W32/Agent.QFO!tr
BitDefenderTheta	AI:Packer.97A973761F
AVG	Win32:Geral [Trj]
Avast	Win32:Geral [Trj]
CrowdStrike	win/malicious_confidence_90% (D)