Categories: Trojan

TrojanDropper:Win32/NetRat.V!MTB removal

The TrojanDropper:Win32/NetRat.V!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper:Win32/NetRat.V!MTB virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Detected script timer window indicative of sleep style evasion
Reads data out of its own binary image
A process created a hidden window
Executed a very long command line or script command which may be indicative of chained commands or obfuscation
A scripting utility was executed
Uses Windows utilities for basic functionality
Network activity detected but not expressed in API logs
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine TrojanDropper:Win32/NetRat.V!MTB?


File Info:
crc32: B96A98ADmd5: afd3f1498c3d8ec86ad7b2e80cd9b5b6name: rt35.exesha1: efbdb229e4c35b8994e2035b1e256580fc7a1a6fsha256: 6e084359be25cd6372588538fa887157d741430afad547ddc14821d772577c5asha512: b6652243969e347cb0a618b90009b8c17c68a12106b9a9c46e3e65579576a6139788b85bed4bfdb1bb6374d5f76fe5e7c6e0593ba1597af712de4a9b3b02775assdeep: 98304:r8eS/tzZWwNqG79nCuX/MuuQ6SF0KzJRZzcOs0iKliMy:Ies0G79CuPb6o0KzfNcOs0iKletype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: DLPTWZFQLF inc 2020FileVersion: 5.0.2.1CompanyName: Icons-Land-Vista-People-Medical-Nurse-Male-Dark.icoLegalTrademarks: DLPTWZFQLF companyComments: DLPTWZFQLFProductName: Icons-Land-Vista-People-Medical-Nurse-Male-DarkTranslation: 0x0409 0x04e4

TrojanDropper:Win32/NetRat.V!MTB also known as:

MicroWorld-eScan	Trojan.PWS.Agent.SVE
CAT-QuickHeal	Trojan.Powershell
ALYac	Trojan.Agent.Wacatac
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.PWS.Agent.SVE
K7GW	Riskware ( 0040eff71 )
TrendMicro	TROJ_GEN.R002C0PE920
Cyren	W32/Trojan.QLWJ-8435
Symantec	Downloader
ESET-NOD32	a variant of Generik.DWGRSVV
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.PowerShell.Generic
Alibaba	Trojan:Application/Generic.e6a8fda1
Emsisoft	MalCert-S.BB (A)
Comodo	Malware@#23192ox96e1of
F-Secure	Malware.VBS/PShell.jrevf
DrWeb	BackDoor.RMS.168
McAfee-GW-Edition	NSIS/Dropper.c
FireEye	Trojan.PWS.Agent.SVE
Sophos	Mal/BadCert-Gen
Ikarus	Trojan-Spy.Agent
Webroot	Trojan.Dropper.Gen
Avira	VBS/PShell.jrevf
Fortinet	NSIS/Agent.C!tr
Endgame	malicious (high confidence)
Arcabit	Trojan.PWS.Agent.SVE
ZoneAlarm	HEUR:Trojan.PowerShell.Generic
Microsoft	TrojanDropper:Win32/NetRat.V!MTB
AhnLab-V3	Win-Trojan/Suspig15.Exp
McAfee	Artemis!AFD3F1498C3D
MAX	malware (ai score=100)
VBA32	Backdoor.RMS
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0PE920
GData	PowerShell.Trojan.Agent.AQX
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
Qihoo-360	Generic/Trojan.d6f