Trojan:Win32/Bladabindi!MTB information

The Trojan:Win32/Bladabindi!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Bladabindi!MTB virus can do?

Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Trojan:Win32/Bladabindi!MTB?


File Info:
name: F2D8E6AE3E25A5262776.mlw
path: /opt/CAPEv2/storage/binaries/6d237209bac11ad6d5dfc6b3e48eaedd1437c987a38b430e5564de9f8624535a
crc32: DC8374D1
md5: f2d8e6ae3e25a5262776574f3756d9b8
sha1: f07372308a99e2600d00907a619ffb45109d2112
sha256: 6d237209bac11ad6d5dfc6b3e48eaedd1437c987a38b430e5564de9f8624535a
sha512: b4baab4e705221782823a4438f7b13f5007837b0258ca41b91b713b96b46758c892b66f4654e72693878eff5f2ca9217e9b98d36d897106df8e322f95c523e08
ssdeep: 196608:Y2+Vf4Y2+VapfHfbsizY0vsQxUy3za7JuEjF1DUh6hfnlDf:Y2rY27vTVY0vskUwmNuEjF1EI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T161C6BE21B6BAC527D5EA15B3692CDBEF50697FA00BB054C763D43E7E19B08C24231E27
sha3_384: f77c612bc158ed7edaf9c46a748db2400a1030f7e65e4669c5f06db912b1ff88f859fb77a02a861999a0b17d051941df
ep_bytes: e817030000e97afeffff836104008bc1
timestamp: 2019-11-13 08:49:41

Version Info:
CompanyName: Techknave
FileDescription: M-Bus Reader Installer
FileVersion: 1.5.1
InternalName: Setup M-Bus Reader
LegalCopyright: Copyright (C) 2021 Techknave
OriginalFileName: Setup M-Bus Reader.exe
ProductName: M-Bus Reader
ProductVersion: 1.5.1
Translation: 0x0409 0x04b0

Trojan:Win32/Bladabindi!MTB also known as:

Lionic	Trojan.Win32.Bladabindi.4!c
McAfee	Artemis!F2D8E6AE3E25
Cylance	Unsafe
Sangfor	Backdoor.Win32.Bladabindi.V05m
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Backdoor:MSIL/Bladabindi.d2655f63
K7GW	Riskware ( 0040eff71 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Generik.JOYKFWL
Kaspersky	Backdoor.MSIL.Bladabindi.bdbd
Avast	Win32:Malware-gen
TrendMicro	TROJ_GEN.R002C0DKB22
McAfee-GW-Edition	BehavesLike.Win32.BadFile.wc
Microsoft	Trojan:Win32/Bladabindi!MTB
BitDefenderTheta	Gen:NN.ZexaF.34784.@x3@aC75Byki
TrendMicro-HouseCall	TROJ_GEN.R002C0DKB22
Rising	Trojan.Generic@AI.84 (RDML:Z7UBeny3pMKFqpv280oKFg)
AVG	Win32:Malware-gen
Panda	Trj/CI.A

How to remove Trojan:Win32/Bladabindi!MTB?

Trojan:Win32/Bladabindi!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X