Trojan

TrojanDropper:Win32/CryptInject.BH!MTB removal tips

Malware Removal

The TrojanDropper:Win32/CryptInject.BH!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What TrojanDropper:Win32/CryptInject.BH!MTB virus can do?

  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Authenticode signature is invalid
  • Binary file triggered YARA rule
  • Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDropper:Win32/CryptInject.BH!MTB?



File Info:

name: 966775E338A803673317.mlw
path: /opt/CAPEv2/storage/binaries/9a9203a96c87866e82ec082ccf1d4469bc0c3ea437b38b09c2597285c9a1bd6e
crc32: BA7A2114
md5: 966775e338a8036733173a6d573d4e00
sha1: 3641b61a05d6abce5710716333b6aa355c4853ef
sha256: 9a9203a96c87866e82ec082ccf1d4469bc0c3ea437b38b09c2597285c9a1bd6e
sha512: 0b21ea7469be57d9a07c0e5b5699cd32f50aae14ce458b6c1efc6f9df1d1b594e5988baa11c02ca6d67b8d0f240388caf8b2b42aeaa0cac64162b8595b6073f6
ssdeep: 3072:8pJL9i55nLXaq5UI+Md0PU4PU4VLaRhsBwXObC9MV:HBmM5d08V4pshswXaSM
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T170A35C01F68441FDE9A9253C18EB7B37DB3B75648A5D4FC3BB28E9650823142BB1634B
sha3_384: c28c92dd83c41f1ed23ff04958a97c40cc97e8959b22216b99b66e34340f1c36b300d9d781b0578ad410395844c675a6
ep_bytes: 558bec538b5d08568b750c578b7d1085
timestamp: 2011-06-23 09:16:37


Version Info:

Comments: 
CompanyName: Sogou.com Inc.
FileDescription: 搜狗拼音输入法 硬件签名工具
FileVersion: 5.2.0.5374
InternalName: SogouPY HWSignature
LegalCopyright: ? 2011 Sogou.com Inc. All rights reserved.
LegalTrademarks: 
OriginalFilename: HWSignature.dll
PrivateBuild: 
ProductName: 搜狗拼音输入法
ProductVersion: 5.2.0.5374
SpecialBuild: 
Translation: 0x0804 0x04b0

TrojanDropper:Win32/CryptInject.BH!MTB also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Gamania.32325
MicroWorld-eScanGen:Variant.Magania.13
CAT-QuickHealBackdoor.Farfli.O
SkyhighBehavesLike.Win32.Ransomware.ch
McAfeeGenericRXAB-TG!966775E338A8
MalwarebytesMalware.AI.3765292188
ZillyaTrojan.Magania.Win32.38978
SangforSuspicious.Win32.Save.ins
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaMalware:Win32/km_2c0fd.None
K7GWTrojan ( 0055e3e41 )
K7AntiVirusTrojan ( 0055e3e41 )
BitDefenderThetaGen:NN.ZedlaF.36802.gu8@aCc3KUhb
VirITTrojan.Win32.OLG.BMQB
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Farfli.VA
APEXMalicious
TrendMicro-HouseCallBKDR_ZEGOST.SMT
ClamAVWin.Trojan.Magania-13517
KasperskyTrojan-GameThief.Win32.Magania.uaoq
BitDefenderGen:Variant.Magania.13
NANO-AntivirusTrojan.Win32.Magania.eaaac
AvastWin32:Farfli-AX [Trj]
Tencentbackdoor.win32.gh0st.ay
EmsisoftGen:Variant.Magania.13 (B)
F-SecureTrojan.TR/Farfli.qnam
VIPREGen:Variant.Magania.13
TrendMicroBKDR_ZEGOST.SMT
FireEyeGeneric.mg.966775e338a80367
SophosTroj/Farfli-Gen
SentinelOneStatic AI – Malicious PE
MAXmalware (ai score=100)
JiangminBackdoor/IRCBot.qan
GoogleDetected
AviraTR/Farfli.qnam
VaristW32/OnlineGames.GR.gen!Eldorado
Antiy-AVLTrojan[GameThief]/Win32.Magania
Kingsoftmalware.kb.a.1000
MicrosoftTrojanDropper:Win32/CryptInject.BH!MTB
XcitiumTrojWare.Win32.Magania.~AAD@f80tc
ArcabitTrojan.Magania.13
ZoneAlarmTrojan-GameThief.Win32.Magania.uaoq
GDataWin32.Trojan.PSE.1EPJP08
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.OnlineGameHack.R3364
VBA32BScope.TrojanPSW.Gamania
ALYacGen:Variant.Magania.13
TACHYONTrojan/W32.Agent.104960.JA
Cylanceunsafe
PandaTrj/Genetic.gen
RisingBackdoor.Farfli!1.9908 (CLASSIC)
YandexTrojan.PWS.Magania!Jetg4UfJFK4
IkarusTrojan-GameThief.Win32.Magania
MaxSecureTrojan.Malware.2518776.susgen
FortinetW32/Farfli.AIL!tr
AVGWin32:Farfli-AX [Trj]
DeepInstinctMALICIOUS
alibabacloudWorm:Win/Farfli.VA

How to remove TrojanDropper:Win32/CryptInject.BH!MTB?

TrojanDropper:Win32/CryptInject.BH!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment