Trojan:Win32/Bunitu.AD!MTB removal tips

The Trojan:Win32/Bunitu.AD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Bunitu.AD!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Installs itself for autorun at Windows startup
• Attempts to identify installed AV products by registry key
• Anomalous binary characteristics

How to determine Trojan:Win32/Bunitu.AD!MTB?

File Info:
name: E3D4D0D3A464FEC0800E.mlw
path: /opt/CAPEv2/storage/binaries/9671e71d7386928eef18ba729f1af333751e48f1052b2b24c347c37a508a730c
crc32: 96790994
md5: e3d4d0d3a464fec0800e2f7fcb9bedc0
sha1: 853d9b1518a386e6ce4f4da29972f76e9a3f4d84
sha256: 9671e71d7386928eef18ba729f1af333751e48f1052b2b24c347c37a508a730c
sha512: d01c8354229d20e1ae8ffcaf4d4f0b64fb4a7cbb9f9ed1bf276ea61885f6f21e1d1d4a474f6f1403e0c09c9fbd495b7849287a7363840f04c5f2f6b3cf0ed28f
ssdeep: 3072:GNovkpZSp3nXn3nXn37EJzXDfB/w+BC3K5eqyDV:2ocpBTuK7yDV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10484F21171D56FE2D5D669743A53E3B802B7CE117712F50B82A0FA62A438FE96C603BC
sha3_384: 0c2421fd3ef83ab165e9c1e4cbcf49d514bc8ffb4b947a85f8e1d88c73a1a031afbb4873458d187fe6535ca945222ea1
ep_bytes: e8f8150000e978feffff8bff558bec8b
timestamp: 2019-01-31 19:03:42

Version Info:
0: [No Data]

Trojan:Win32/Bunitu.AD!MTB also known as:

How to remove Trojan:Win32/Bunitu.AD!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.