About “Trojan:Win32/Darkbot.GJT!MTB” infection

The Trojan:Win32/Darkbot.GJT!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Darkbot.GJT!MTB virus can do?

Sample contains Overlay data
Authenticode signature is invalid

How to determine Trojan:Win32/Darkbot.GJT!MTB?


File Info:
name: 4F6B752B2936360930F6.mlw
path: /opt/CAPEv2/storage/binaries/f9febbb9ac6214ddeea5e3995c37f9bb80f5efbe32b696252fa61ff85eee2316
crc32: 2D5AB24E
md5: 4f6b752b2936360930f6fdfc9dd8c2b8
sha1: 470714e24fb21bc9deaa6a8d14edd1033a0cba7e
sha256: f9febbb9ac6214ddeea5e3995c37f9bb80f5efbe32b696252fa61ff85eee2316
sha512: c5b2c508abae9eaa30225a8200acee05049199bc8cc75ac13b6d031954b02a4fcf0032279e4ce6073370cda6b242136c4fa19e134c2db6c47008cca446d49ad6
ssdeep: 3072:ka9JyHCjnEN5SurHIynr0H6yL6PrKr/Y6N0j55uw4omPMU0GhSRmV2:kcUHOENxFtrKr3ejbmMK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13E34D012B5E1C3F3C28AC13043A9CFB14A79B1743B9ADC87BB5517AA6E50FC1053639A
sha3_384: 3b7fccd86790f477dfc73cb478a90cdf0d6e84ecc969bdc900660ea4d5ef3df23a2d5f531c218785d10a7f57c310ade1
ep_bytes: 66898d0cd4ffffbaaf0000006689950e
timestamp: 2014-12-27 23:45:55

Version Info:
0: [No Data]

Trojan:Win32/Darkbot.GJT!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.GenericML.4!c
ClamAV	Win.Trojan.Mresmon-7996024-0
FireEye	Generic.mg.4f6b752b29363609
Skyhigh	BehavesLike.Win32.Generic.dh
McAfee	Artemis!4F6B752B2936
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
BitDefender	Gen:Variant.Fragtor.428058
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Win32.GenericML.xnet
Alibaba	Trojan:Win32/Darkbot.2fd8b8ee
MicroWorld-eScan	Gen:Variant.Fragtor.428058
Rising	Trojan.Generic@AI.100 (RDML:/o/1NyVdqYrzYLbqUcRztQ)
Emsisoft	Gen:Variant.Fragtor.428058 (B)
F-Secure	Trojan.TR/Crypt.XPACK.Gen2
VIPRE	Gen:Variant.Fragtor.428058
TrendMicro	TROJ_GEN.R002C0DK523
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Injector
Avira	TR/Crypt.XPACK.Gen2
MAX	malware (ai score=89)
Antiy-AVL	Worm/Win32.Dorkbot.gen
Kingsoft	malware.kb.a.998
Microsoft	Trojan:Win32/Darkbot.GJT!MTB
Arcabit	Trojan.Fragtor.D6881A
ZoneAlarm	UDS:Trojan.Win32.GenericML.xnet
GData	Win32.Trojan.PSE.1WSBK2Q
Google	Detected
BitDefenderTheta	Gen:NN.ZexaF.36792.oqY@ay6Ye8b
ALYac	Gen:Variant.Fragtor.428058
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.2629931481
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0DK523
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.185628869.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:MalwareX-gen [Trj]
Cybereason	malicious.24fb21
Avast	Win32:MalwareX-gen [Trj]

How to remove Trojan:Win32/Darkbot.GJT!MTB?

Trojan:Win32/Darkbot.GJT!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X