Trojan

How to remove “Trojan:MSIL/Formbook.ALY!MTB”?

Malware Removal

The Trojan:MSIL/Formbook.ALY!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:MSIL/Formbook.ALY!MTB virus can do?

  • Dynamic (imported) function loading detected
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan:MSIL/Formbook.ALY!MTB?



File Info:

name: 7D50CA70BFF094575182.mlw
path: /opt/CAPEv2/storage/binaries/a59584b56e441105efa83722c78737df246a0ed1e76d2b1c3c20e7c1581d9cae
crc32: 5A3388A0
md5: 7d50ca70bff094575182ed4a262bdfe0
sha1: 3be7106531cc7a8685b09abe19420991b20f2095
sha256: a59584b56e441105efa83722c78737df246a0ed1e76d2b1c3c20e7c1581d9cae
sha512: 014c99b4918c99677780205ce78f538ca2a671b1e0ba7b6245c2a974e459c9ee127893cfaaaefcf442fc04e69e50ace4e03ce164c7eadf45f61cd3bbef865b8f
ssdeep: 768:WuiEX4NzthicQP+pAgka/8HHUTQQQQQQQBdy3bI91GN6bcE/2ihWSCAtkrjL1FpO:Q84N1jpga/eHUTQQQQQQQBdBgN6b5/2b
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12823F801D6AA0363D6A987F2B49356C307B5640E58F0CA7A9CC6B0DE19EF7056583FCB
sha3_384: e368f18853cb2790d20ca3ed8a70a455fe2b29a03cdadc4bc4d1f3c841dec22ff8f499e1baffc5534d5b615330038dee
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-02-07 06:52:51


Version Info:

Translation: 0x0000 0x04b0
FileDescription: ffvvbgd
FileVersion: 1.0.0.0
InternalName: ffvvbgd.exe
LegalCopyright: Copyright ©  2022
OriginalFilename: ffvvbgd.exe
ProductName: ffvvbgd
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan:MSIL/Formbook.ALY!MTB also known as:

LionicTrojan.MSIL.Injects.4!c
MicroWorld-eScanTrojan.GenericKD.38997849
FireEyeGeneric.mg.7d50ca70bff09457
CAT-QuickHealTrojan.FormBook
McAfeeRDN/XLoader
CylanceUnsafe
SangforTrojan.MSIL.Injects.gen
K7AntiVirusTrojan-Downloader ( 0058d3d91 )
BitDefenderTrojan.GenericKD.38997849
K7GWTrojan-Downloader ( 0058d3d91 )
BitDefenderThetaGen:NN.ZemsilF.34264.cm0@aaYggbb
VirITTrojan.Win32.PSWStealer.DFN
CyrenW32/MSIL_Kryptik.GQD.gen!Eldorado
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/TrojanDownloader.Agent.KBO
TrendMicro-HouseCallTROJ_FRS.0NA103B922
Paloaltogeneric.ml
KasperskyHEUR:Trojan.MSIL.Injects.gen
AlibabaTrojan:MSIL/Generic.d7391757
ViRobotTrojan.Win32.S.Downloader.48640.AM
TencentMsil.Trojan.Injects.Ajlo
Ad-AwareTrojan.GenericKD.38997849
EmsisoftTrojan.GenericKD.38997849 (B)
ComodoMalware@#1j2oke42a5qap
ZillyaDownloader.Agent.Win32.461449
TrendMicroTROJ_FRS.0NA103B922
McAfee-GW-EditionRDN/XLoader
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
JiangminTrojan.MSIL.amagj
Antiy-AVLTrojan/Generic.ASMalwS.3527366
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftTrojan:MSIL/Formbook.ALY!MTB
GridinsoftTrojan.Win32.Downloader.sa
GDataTrojan.GenericKD.38997849
CynetMalicious (score: 100)
AhnLab-V3Infostealer/Win.Generic.C4954562
ALYacTrojan.Agent.FormBook
VBA32TScope.Trojan.MSIL
MalwarebytesTrojan.Downloader.MSIL.Generic
PandaTrj/GdSda.A
APEXMalicious
RisingTrojan.Generic/MSIL@AI.90 (RDM.MSIL:CkysoM53B1zZYug6yfJKJw)
YandexTrojan.Igent.bXrjF9.20
MAXmalware (ai score=80)
MaxSecureTrojan.Malware.74363616.susgen
FortinetMSIL/Kryptik.ADPN!tr
WebrootW32.Trojan.Gen
AVGWin32:DropperX-gen [Drp]
AvastWin32:DropperX-gen [Drp]
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan:MSIL/Formbook.ALY!MTB?

Trojan:MSIL/Formbook.ALY!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment