Trojan

How to remove “Trojan:Win32/Crypt.CJ!MTB”?

Malware Removal

The Trojan:Win32/Crypt.CJ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:Win32/Crypt.CJ!MTB virus can do?

  • At least one process apparently crashed during execution
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Dynamic (imported) function loading detected
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Trojan:Win32/Crypt.CJ!MTB?



File Info:

name: FD27B35CA531D8D3E3BA.mlw
path: /opt/CAPEv2/storage/binaries/d9d1875f24effeaada3c6ec8b93a00632c07414e7420c7dc72361f063499a862
crc32: 88BAF507
md5: fd27b35ca531d8d3e3ba1b04e0d94558
sha1: 869463a86deace3a1d608a7c9c1e2d1b70e62c5a
sha256: d9d1875f24effeaada3c6ec8b93a00632c07414e7420c7dc72361f063499a862
sha512: 7c9fd33f103533005f4e8126096a5862b7ea04fa947d378d65c5cfd4d752b7605adb798fb65c7d965d02b00f25effefbdba0689d41f4adc3977278d9a9118cf6
ssdeep: 3072:YMiSZl9A5DMh1lSxC7eSth3nmKKzC8EFQzPH2LHBBMfaZm7iFX+p3sxJW2WmS:3Zl9jSFS33mK8EFiYHISZuUupcxJA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17434F12A28B86F04D4232335711B2F3595F59B2F3E66565CF6FE83B1E534A040A231AF
sha3_384: 5e16d05e6ef4f3ad7c882c28cc682536184567abe6c63ec22674417c7872998a9db5dac15b581d10fe03dcc64eb69ea0
ep_bytes: 60be00c0c1018dbe00507efe57eb0b90
timestamp: 2022-02-05 21:47:36


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Host Process for Windows Service
FileVersion: 2.0.0.0
InternalName: sqhost.exe
LegalCopyright: Copyright (C) 2016
OriginalFilename: sqhost.exe
ProductName: sqhost.exe
ProductVersion: 2.0.0.0
Translation: 0x0409 0x04b0

Trojan:Win32/Crypt.CJ!MTB also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Heur.Variadic.Prometei.A
FireEyeGeneric.mg.fd27b35ca531d8d3
ALYacGen:Heur.Variadic.Prometei.A
CylanceUnsafe
BitDefenderGen:Heur.Variadic.Prometei.A
Cybereasonmalicious.ca531d
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.AXYT
APEXMalicious
KasperskyUDS:Trojan-Downloader.Win32.Agent
RisingTrojan.Agent!8.B1E (RDMK:cmRtazqwVcubgPJymVZE0NO2j3sK)
Ad-AwareGen:Heur.Variadic.Prometei.A
EmsisoftGen:Trojan.Heur.om1@tSW3T4di (B)
McAfee-GW-EditionBehavesLike.Win32.Fake.dc
SophosGeneric ML PUA (PUA)
SentinelOneStatic AI – Malicious PE
GDataGen:Heur.Variadic.Prometei.A
AviraTR/Crypt.FKM.Gen
MAXmalware (ai score=85)
ArcabitTrojan.Variadic.Prometei.A
MicrosoftTrojan:Win32/Crypt.CJ!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.CoinMiner.R413841
McAfeeArtemis!FD27B35CA531
MalwarebytesTrojan.BitCoinMiner
PandaTrj/GdSda.A
IkarusTrojan.Win32.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Agent.UBS!tr
BitDefenderThetaAI:Packer.E5451CAC1F
AVGWin32:Trojan-gen
AvastWin32:Trojan-gen
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Trojan:Win32/Crypt.CJ!MTB?

Trojan:Win32/Crypt.CJ!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment