Trojan:Win32/Antavmu.GFS!MTB removal

The Trojan:Win32/Antavmu.GFS!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Antavmu.GFS!MTB virus can do?

Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Dynamic (imported) function loading detected
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan:Win32/Antavmu.GFS!MTB?


File Info:
name: 748A28C033372C93009A.mlw
path: /opt/CAPEv2/storage/binaries/c2ab7d6d0f8e195fc0177f904be6cf9e1acd84c22d7455edc93432db12863878
crc32: 1F277150
md5: 748a28c033372c93009a4d4cda48f6ba
sha1: 9c966a822264f2783174798327d12773c989c568
sha256: c2ab7d6d0f8e195fc0177f904be6cf9e1acd84c22d7455edc93432db12863878
sha512: 5db42f4f87b54324596cd4a64027bfa68510d4829042943f454195292bca8f51e6478aa35a189eb55092bf060d96cdf826bd07264cf7db8fdb10611dcc851ea6
ssdeep: 6144:bwADfLqvpE7SU8uMwV+GYmlrHJuxRxwrI/SnDCTt2rzF+PfnCl:bwArLrZ8kV+LmyxRxwrI6DLzY3Cl
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FC8423CE414DC235CA4B15BE2636E6EC16129A111326E67FB67D43F4AE7C2CF5A210E3
sha3_384: 58dd896ec0c3b0f35241de267ac7d0d48864d7da960d410cb82f3d25ebf6c134bd914009845bccd2fc5a3448b97ef167
ep_bytes: 559c60648b05300000008b406883e070
timestamp: 2022-01-18 07:19:48

Version Info:
Comments: AGASDG
CompanyName: EWAGF
FileDescription: AGSA 
FileVersion: ADSA
InternalName: AASG
LegalCopyright: ADSGAG
LegalTrademarks: 
OriginalFilename: loder.dat
PrivateBuild: 
ProductName: Microsoft Corporation loder
ProductVersion: 1, 0, 0, 1
SpecialBuild: 
Translation: 0x0c04 0x04e3

Trojan:Win32/Antavmu.GFS!MTB also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.wi0@taMdo4o
FireEye	Generic.mg.748a28c033372c93
McAfee	RDN/Generic PWS.y
Malwarebytes	Malware.AI.1626110794
CrowdStrike	win/malicious_confidence_60% (W)
BitDefender	Gen:Trojan.Heur.wi0@taMdo4o
BitDefenderTheta	AI:Packer.4FFE99F422
Cyren	W32/Troj_Obfusc.N.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HNKL
Kaspersky	Trojan-PSW.Win32.QQPass.abvu
NANO-Antivirus	Trojan.Win32.QQPass.csvqb
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazrQXC9mc1ZR0+YlaH7kbT4E)
Ad-Aware	Gen:Trojan.Heur.wi0@taMdo4o
Sophos	Mal/EncPk-AQB
Comodo	TrojWare.Win32.Kryptik.~NNZ@1qgexn
McAfee-GW-Edition	BehavesLike.Win32.Trojan.fc
SentinelOne	Static AI – Malicious PE
Emsisoft	Gen:Trojan.Heur.wi0@taMdo4o (B)
APEX	Malicious
GData	Gen:Trojan.Heur.wi0@taMdo4o
Jiangmin	Trojan/PSW.QQPass.mtj
eGambit	Unsafe.AI_Score_99%
Avira	TR/Crypt.ZPACK.Gen
Antiy-AVL	Trojan/Generic.ASBOL.F88
Microsoft	Trojan:Win32/Antavmu.GFS!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.QQPass.R116748
Acronis	suspicious
VBA32	BScope.Trojan.Wacatac
ALYac	Gen:Trojan.Heur.wi0@taMdo4o
MAX	malware (ai score=82)
Tencent	Trojan.Win32.Farfli.aaf
Fortinet	W32/GenKryptik.FOYK!tr
Cybereason	malicious.033372

How to remove Trojan:Win32/Antavmu.GFS!MTB?

Trojan:Win32/Antavmu.GFS!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X