About “Trojan:MSIL/Bladabindi.ZAREGA!MTB” infection

The Trojan:MSIL/Bladabindi.ZAREGA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/Bladabindi.ZAREGA!MTB virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
Anomalous .NET characteristics
Anomalous binary characteristics

How to determine Trojan:MSIL/Bladabindi.ZAREGA!MTB?


File Info:
name: 24680CB02EFC8D829C4D.mlw
path: /opt/CAPEv2/storage/binaries/5eae4fa35e063ca68a0e86c0d9c190e3874e3c1feb457246f8457866b77ed164
crc32: 752E2E20
md5: 24680cb02efc8d829c4de876b22fcba4
sha1: 12dc2cc024d5f4253fa18d6b672e3a32453c8a95
sha256: 5eae4fa35e063ca68a0e86c0d9c190e3874e3c1feb457246f8457866b77ed164
sha512: 3ac038d2fd5f89a78352daf0b6730d6ea707cca193de0474316153fb84b9e6390a7eb094ef7ded4ac10a816508452940c0815a3806579e1a82a9eb0f61224799
ssdeep: 192:YzRu0pai792+A3fjCI60XOtu9EqOnj0WTaY:QRue92+AvjCI6oOtd0WTaY
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T12712D81433F88109F1FF8F7618F13A66457AF6536A13D25E1895439A4E32A80CB92B7B
sha3_384: 287f30b0ec1af6e51941a76c9e24a5841483605e1ee9608e1fb8864ae1f75f9f5b6c75a7c87077c648a8a7dd5182d9b6
ep_bytes: 4d5a90000300000004000000ffff0000
timestamp: 2022-04-09 13:29:17

Version Info:
Translation: 0x0000 0x04b0
Comments: Shell Infrastructure Host
FileDescription: Shell Infrastructure Host
FileVersion: 10.0.19041.746
InternalName: DiscordNitroMiner-watchdog.exe
LegalCopyright: © Microsoft Corporation. All Rights Reserved.
OriginalFilename: DiscordNitroMiner-watchdog.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.746
Assembly Version: 0.0.0.0

Trojan:MSIL/Bladabindi.ZAREGA!MTB also known as:

MicroWorld-eScan	IL:Trojan.MSILZilla.12047
FireEye	Generic.mg.24680cb02efc8d82
ALYac	IL:Trojan.MSILZilla.12047
BitDefender	IL:Trojan.MSILZilla.12047
Cyren	W64/MSIL_Coinminer.C.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/CoinMiner.CGV
ClamAV	Win.Trojan.Msilzilla-9939173-0
Kaspersky	HEUR:Backdoor.MSIL.Bladabindi.gen
Ad-Aware	IL:Trojan.MSILZilla.12047
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	CoinMiner-FEH!24680CB02EFC
SentinelOne	Static AI – Malicious PE
Emsisoft	IL:Trojan.MSILZilla.12047 (B)
Ikarus	Trojan.Win32.CoinMiner
GData	IL:Trojan.MSILZilla.12047
Avira	HEUR/AGEN.1221914
Arcabit	IL:Trojan.MSILZilla.D2F0F
ZoneAlarm	HEUR:Backdoor.MSIL.Bladabindi.gen
Microsoft	Trojan:MSIL/Bladabindi.ZAREGA!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4785167
Acronis	suspicious
McAfee	CoinMiner-FEH!24680CB02EFC
MAX	malware (ai score=80)
Malwarebytes	Trojan.BitCoinMiner.Generic
APEX	Malicious
Tencent	Trojan.Win64.BitCoinMiner.16000099
Fortinet	MSIL/CoinMiner.CGV!tr
AVG	Win64:CoinminerX-gen [Trj]
Avast	Win64:CoinminerX-gen [Trj]

How to remove Trojan:MSIL/Bladabindi.ZAREGA!MTB?

Trojan:MSIL/Bladabindi.ZAREGA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X