Trojan:MSIL/njRAT.RDSA!MTB removal tips

The Trojan:MSIL/njRAT.RDSA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:MSIL/njRAT.RDSA!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Creates an autorun.inf file
• Authenticode signature is invalid
• Anomalous .NET characteristics
• Uses Windows utilities for basic functionality
• CAPE detected the njRat malware family
• Creates a copy of itself
• Creates known Njrat/Bladabindi RAT registry keys

How to determine Trojan:MSIL/njRAT.RDSA!MTB?

File Info:
name: 82366DB26B8208D923F4.mlw
path: /opt/CAPEv2/storage/binaries/a0aa66f6639e2b54a908115571c85285598845d3e52888fe27c6b35f6900fe56
crc32: FF46C23D
md5: 82366db26b8208d923f478090873daa3
sha1: 7d75f820d51ee19c56efa9f0bb9ca025fee0cc0b
sha256: a0aa66f6639e2b54a908115571c85285598845d3e52888fe27c6b35f6900fe56
sha512: 2513d7f4d3edf4ace34e32ced962a7c02a4c0027600271fe3fad3cfd635f402729a511a1d126f6f6db5b91890f42b230fc9deae817d99f003c431c7b5c40f93c
ssdeep: 384:nO2m3hUidkiXR21cGMy8PuuRXBiFlK6IurAF+rMRTyN/0L+EcoinblneHQM3epzx:O2m3VLGv8PuuR066XrM+rMRa8Nuestd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DB134A4D7FE14168C9FD0A7705B2D423077AE14B2D63D90E9EF1A49A3B636D08F509E2
sha3_384: 8972ab3e0f1c2a844f44c8c0390d12bf2f901e85cb912e2247c21b41619cedf749ff8683a994555cfcb33409d35f000c
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-03-04 15:48:21

Version Info:
0: [No Data]

Trojan:MSIL/njRAT.RDSA!MTB also known as:

How to remove Trojan:MSIL/njRAT.RDSA!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.