Should I remove “Trojan:Win32/Azorult.N!MTB”?

The Trojan:Win32/Azorult.N!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Azorult.N!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese (Hongkong)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• CAPE detected the Raccoon malware family

How to determine Trojan:Win32/Azorult.N!MTB?

File Info:
name: C1F6ADAEF5A1AD06ECCB.mlw
path: /opt/CAPEv2/storage/binaries/4e89904593d8709d655956623fedffb7137ece77ea70c4097e8f4390952c7f4d
crc32: EB2B6872
md5: c1f6adaef5a1ad06eccb097e0db2f4ec
sha1: 551e598a8ee715eb308e067ec6ffb0fd913661fd
sha256: 4e89904593d8709d655956623fedffb7137ece77ea70c4097e8f4390952c7f4d
sha512: 0eb7e5193678032e9b0758ba9b685ea2c7eaec60db898e628e341f0a6c3574bcd8c65458ef756999e96f42f5bc2eeeee2334038ba21cde5fa15b29f358ad29ff
ssdeep: 12288:fBCT7pKG9WfnzQSPxw3ePNasrjRz8rH3KmqClXZT0yXzPKao21NFPeL/9td1mrRW:iIlzQUw34zFIDKqX2yXzPKq1NleLt18W
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T134E4F110A7A0D039F2B712F4457A93A9B93E7EA25B3461CB53D52AEA57347E0EC31307
sha3_384: 7c25d311a91659539dae98b5f3db07f5ab05b29db03f1d05d40265caa32fa2aaacd2f392a8ddce9cf9b74960d0776798
ep_bytes: 8bff558bece866d70000e8110000005d
timestamp: 2020-11-12 03:44:56

Version Info:
0: [No Data]

Trojan:Win32/Azorult.N!MTB also known as:

How to remove Trojan:Win32/Azorult.N!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.