Should I remove “Trojan:Win32/Conteban.B!rfn”?

The Trojan:Win32/Conteban.B!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Conteban.B!rfn virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Trojan:Win32/Conteban.B!rfn?

File Info:
name: 396A0145A594E4F81DD6.mlw
path: /opt/CAPEv2/storage/binaries/0f7fb5cfdfed45d552c536b852b9fcd1b601efe46752c16c89d074002a63dce4
crc32: 8BEF4AE7
md5: 396a0145a594e4f81dd61a370cd82d1c
sha1: 09f4c0aebd4f7366ee75162a98efa32f0a1616f1
sha256: 0f7fb5cfdfed45d552c536b852b9fcd1b601efe46752c16c89d074002a63dce4
sha512: 9f2d6b5a1206127f1e7d1050359c75161897ab3b3399b60db5f769b2a0952965a462bafaa7ce9db168fc4f3210c2234e2ded0a7f8b8e0b273a8d2f9469b67db7
ssdeep: 24576:pAT8QE+kiOW/mlBKx3NKUsEebap9RhdYM/rn2lEsMv0+49kBre/iD7:pAI+EdBKxsntbap9jiArq3wD+kBZX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CD551239B2428477C0220A75494BD2B7F537BB041EBD21CFB3D95E2D9E332552A623E6
sha3_384: 62927b6190d3b0dcfa74584d7ef059b259cb46a082aa4e70705d90cb1c9644a92cdf5de0592dae1574a4401f552f2fc7
ep_bytes: 558bec83c4f0b888534200e824f2fdff
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: 
CompanyName: kos1                                                        
FileDescription: kos1 1.00 Installation                                      
FileVersion: 1.00                
LegalCopyright: kos1                                                                                                
Translation: 0x0409 0x04e4

Trojan:Win32/Conteban.B!rfn also known as:

How to remove Trojan:Win32/Conteban.B!rfn?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.