Trojan:Win32/Dridex.AHB!MTB removal tips

The Trojan:Win32/Dridex.AHB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Dridex.AHB!MTB virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

How to determine Trojan:Win32/Dridex.AHB!MTB?


File Info:
crc32: F5BFC6B4
md5: f0242add3e62b4bda6a1f3e38e98a73d
name: F0242ADD3E62B4BDA6A1F3E38E98A73D.mlw
sha1: 857af8c917c75720e5787b372612ff1f15a3f7c0
sha256: 18b60baa2088c1d38889054818f767eaa9098f1371b01e1fbbb6941395bbd85b
sha512: eda748a1b41dd4667d74b342e40db98631df07b22c775c0a9428727e247e857e06132b5c4eae5ac25106927bf90093a013cf5a12c6f57a97a552c06ff1f6ade4
ssdeep: 3072:ZhYiCQXKgH7xFjsDlyk+AZ6cGdgwQDDu15/aE8t7grkVCuLnT:z7xFGlyfAZ5DDuLyTzT
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2006 The PHP Group
InternalName: ovo
FileVersion: 7.3.0.0
CompanyName: The PHP Group
URL: http://www.php.net
PrivateBuild: 
LegalTrademarks: php
Comments: 
ProductName: OVO Hdsynn Ossd
SpecialBuild: 
ProductVersion: 7.3.0
FileDescription: PHP Script Interpreter
OriginalFilename: ovo4hd.dll
Translation: 0x0409 0x04b0

Trojan:Win32/Dridex.AHB!MTB also known as:

Elastic	malicious (high confidence)
ClamAV	Win.Packed.Dridex-9886732-0
ALYac	Gen:Variant.Zusy.397939
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Cyren	W32/Dridex.EV.gen!Eldorado
Symantec	Packed.Generic.517
ESET-NOD32	Win32/Dridex.DT
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	VHO:Trojan-Downloader.Win32.Cridex.gen
BitDefender	Gen:Variant.Zusy.397939
MicroWorld-eScan	Gen:Variant.Zusy.397939
Ad-Aware	Gen:Variant.Zusy.397939
Sophos	ML/PE-A + Mal/EncPk-APX
BitDefenderTheta	Gen:NN.ZedlaF.34088.lu8@aerzJSni
McAfee-GW-Edition	Drixed-FJX!F0242ADD3E62
FireEye	Generic.mg.f0242add3e62b4bd
Emsisoft	Gen:Variant.Zusy.397939 (B)
SentinelOne	Static AI – Suspicious PE
Antiy-AVL	Trojan/Generic.ASMalwS.346B3EF
Microsoft	Trojan:Win32/Dridex.AHB!MTB
Arcabit	Trojan.Zusy.D61273
GData	Gen:Variant.Zusy.397939
AhnLab-V3	Trojan/Win.Dridex.R437677
McAfee	Drixed-FJX!F0242ADD3E62
MAX	malware (ai score=80)
VBA32	TrojanDownloader.Cridex
Malwarebytes	Trojan.Dridex
Panda	Trj/GdSda.A
Rising	Trojan.Kryptik!1.D8A4 (CLASSIC)
Yandex	Trojan.DL.Cridex!Nkj2bujPRYc
Ikarus	Trojan-Banker.Dridex
Fortinet	W32/Dridex.LSP!tr
AVG	Win32:BankerX-gen [Trj]

How to remove Trojan:Win32/Dridex.AHB!MTB?

Trojan:Win32/Dridex.AHB!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X