About "Trojan:Win32/Dridex.NL!MTB" infection

The Trojan:Win32/Dridex.NL!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Dridex.NL!MTB virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (3 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Collects information about installed applications
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Dridex.NL!MTB?


File Info:
crc32: 3E0071E1
md5: 9d9c1d19818e75ccf8c9de90709f26ce
name: 9D9C1D19818E75CCF8C9DE90709F26CE.mlw
sha1: c2c3eef61cd0750851b1113b7f5d657e9d7a5627
sha256: cc242ab99ab6100dcdc98f004f26041fdd5b67015630d73bff76b03a3d2d607f
sha512: 2317e9ede6cbc0dc179d0e17ea7bb49192603586814dc9fd456c7449829e55c265351bd1aa4643b1ea610f99f1ba5109f99eb4e256f96e4ce2e13f9069e2d9e7
ssdeep: 12288:7SDs0Ljpezsf/Lrxn9AiQwvM8hZDgh6cVBsepVEsY7/ICmco0ADXEwRsZ:WDrszsHxfjv7Dg1Dc7/IxEwRs
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Quite cover xa9 2017 Life self
Unit invent: Multiply chance
InternalName: WeType
FileVersion: 6.4.1.612
CompanyName: Mark duck
ProductName: save.dll
ProductVersion: 6.4.1.612
FileDescription: Quite cover
Translation: 0x0409 0x04b0

Trojan:Win32/Dridex.NL!MTB also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.36250410
FireEye	Generic.mg.9d9c1d19818e75cc
ALYac	Trojan.GenericKD.36250410
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005669021 )
BitDefender	Trojan.GenericKD.36250410
K7GW	Trojan ( 005669021 )
Symantec	Trojan.Gen.MBT
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Banker.Win32.Cridex.gen
Alibaba	TrojanBanker:Win32/Dridex.5c12c327
Ad-Aware	Trojan.GenericKD.36250410
Emsisoft	Trojan.Agent (A)
Comodo	Malware@#1nixyn5b82aq5
F-Secure	Trojan.TR/AD.Dridex.jcckv
DrWeb	Trojan.Dridex.735
TrendMicro	TROJ_FRS.0NA104AR21
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Dridex
Avira	TR/AD.Dridex.jcckv
MAX	malware (ai score=88)
Kingsoft	Win32.Troj.Banker.(kcloud)
Microsoft	Trojan:Win32/Dridex.NL!MTB
Arcabit	Trojan.Generic.D229232A
ZoneAlarm	HEUR:Trojan-Banker.Win32.Cridex.gen
GData	Trojan.GenericKD.36250410
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R364374
McAfee	GenericRXNL-NM!9D9C1D19818E
Malwarebytes	Trojan.Dridex
Panda	Trj/Agent.PM
ESET-NOD32	Win32/Dridex.DD
TrendMicro-HouseCall	TROJ_FRS.0NA104AR21
Fortinet	W32/Kryptik.FANW!tr
AVG	Win32:TrojanX-gen [Trj]
Avast	Win32:TrojanX-gen [Trj]
Qihoo-360	Win32/Trojan.8a8

How to remove Trojan:Win32/Dridex.NL!MTB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Trojan:Win32/Dridex.NL!MTB” infection