What is “Trojan:MSIL/RedLine.MD!MTB”?

The Trojan:MSIL/RedLine.MD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:MSIL/RedLine.MD!MTB virus can do?

Sample contains Overlay data
Authenticode signature is invalid
CAPE detected the RedLine malware family
Anomalous binary characteristics
Binary compilation timestomping detected

How to determine Trojan:MSIL/RedLine.MD!MTB?


File Info:
name: DC190F378825C9AF9599.mlw
path: /opt/CAPEv2/storage/binaries/f0d141a643e216ed58b8d90d4210737f5628eb3d45488582eaeee7dfd2e05328
crc32: 1E3E96D4
md5: dc190f378825c9af9599520c46afb61b
sha1: fe1b91bd1438bac81f3ea0cdfaf07279259c3bb3
sha256: f0d141a643e216ed58b8d90d4210737f5628eb3d45488582eaeee7dfd2e05328
sha512: 980479c0b1e102c6dd38dea4ca065844a62e4a52fde2756af70ac5a9cef6bd8cbb90b7de3ff07768911c89185c3b3b258d7da8ad5c97fc8ac84d27b94d92e85a
ssdeep: 3072:bTrv7Zn47I0TCcc0O95bb2uME0eCbbX9Xp9buoJ58e8hg:jvS7I0TCccUuME0J9Xp9bDP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E114C558364BA97EC96F483E9C700DD0B67C6C671246AB07988EF4E8393B7819F150F6
sha3_384: 0803542e884c86fcf46e71b5b53389656e6f08b273248d4a8f306065bbbf564819021e3a7c45997a56cfc2302ea00a79
timestamp: 2041-07-04 14:07:04

Version Info:
0: [No Data]

Trojan:MSIL/RedLine.MD!MTB also known as:

Elastic	Windows.Trojan.RedLineStealer
Cynet	Malicious (score: 100)
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Unwanted-Program ( 0059886f1 )
K7GW	Unwanted-Program ( 0059886f1 )
Cyren	W32/Stealer.EB.gen!Eldorado
APEX	Malicious
ClamAV	Win.Packed.Lazy-9958163-0
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Generic.cm
FireEye	Generic.mg.dc190f378825c9af
SentinelOne	Static AI – Malicious PE
Microsoft	Trojan:MSIL/RedLine.MD!MTB
Xcitium	Heur.Corrupt.PE@1z141z3
Google	Detected
Rising	Stealer.Agent!1.E5F0 (CLASSIC)
Ikarus	Trojan-Spy.RedLineStealer
Fortinet	MSIL/RedLineStealer.205B!tr.spy
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Trojan:MSIL/RedLine.MD!MTB?

Trojan:MSIL/RedLine.MD!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X