About "Trojan:Win32/Dridex.NM!MTB" infection

The Trojan:Win32/Dridex.NM!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Dridex.NM!MTB virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Collects information about installed applications
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Dridex.NM!MTB?


File Info:
crc32: 2B03E0B6
md5: a99154fbbed0bdc3890f12f0838d4421
name: A99154FBBED0BDC3890F12F0838D4421.mlw
sha1: 1210dbeda761dcdd238ec7f2fd8edcf2f95f06ec
sha256: 79cb6fbec37065789f58b5f57daf2fd7c458c68401071a23830f5ed45a24cf7b
sha512: 612ab9cb02874b00ea4b52024b8c37e010044559a4e64943d73269b450e5775a2d5ff80d821b7ff3ceded562f08da3364b4f0e2f09cc3acf26c9cbd81c1cc0f0
ssdeep: 3072:laYiDmT9TRuJ3OETXsPk1lsFbNJdD1Lw0q0LddiDRs6WtWeCJfY6mv5YvfldCn:lRRa+E96ndD1Lw0qAd0Du/6mv5UdC
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (c) 2003-2005 Trend Micro Incorporated. All rights reserved.
InternalName: hedltreuiv.exe
FileVersion: 6.90.0000
CompanyName: Trend Micro Incorporated
ProductName: HEDltreuiv
ProductVersion: 6.90
FileDescription: CWShredder
OriginalFilename: hedltreuiv.exe
Translation: 0x0409 0x04e4

Trojan:Win32/Dridex.NM!MTB also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.72807
FireEye	Generic.mg.a99154fbbed0bdc3
CAT-QuickHeal	Trojan.AgentPMF.S18595088
Qihoo-360	HEUR/QVM40.1.8A2E.Malware.Gen
ALYac	Spyware.Banker.Dridex
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Trojan.GenericKDZ.72807
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
BitDefenderTheta	Gen:NN.ZedlaF.34590.pu8@aWyVdCoi
Cyren	W32/MSIL_Kryptik.CZY.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HJJF
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
ClamAV	Win.Malware.Bankerx-9829227-0
Kaspersky	HEUR:Trojan.Win32.Yakes.vho
NANO-Antivirus	Trojan.Win32.Dridex.ikansq
Rising	Trojan.Kryptik!1.D257 (RDMK:cmRtazoX3tfqgbzhQmi9t94L7NXJ)
Ad-Aware	Trojan.GenericKDZ.72807
Sophos	Mal/EncPk-APX
F-Secure	Trojan.TR/Crypt.Agent.igxgs
DrWeb	Trojan.Dridex.762
Zillya	Trojan.Agent.Win32.1714994
TrendMicro	TrojanSpy.Win32.DRIDEX.SM.hp
McAfee-GW-Edition	Drixed-FJX!A99154FBBED0
Emsisoft	Trojan.Crypt (A)
Ikarus	Trojan-Banker.Dridex
Jiangmin	Trojan.Agent.dcvt
Avira	TR/Crypt.Agent.igxgs
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	Trojan:Win32/Dridex.NM!MTB
Gridinsoft	Ransom.Win32.Banker.oa!s3
Arcabit	Trojan.Generic.D11C67
AhnLab-V3	Malware/Win32.RL_Generic.R365074
ZoneAlarm	HEUR:Trojan.Win32.Yakes.vho
GData	Trojan.GenericKDZ.72807
Cynet	Malicious (score: 100)
McAfee	Drixed-FJX!A99154FBBED0
Malwarebytes	Trojan.Dridex
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TrojanSpy.Win32.DRIDEX.SM.hp
Yandex	Trojan.Kryptik!ED35wZpIkbE
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Cridex.62A8!tr
AVG	Win32:BankerX-gen [Trj]
MaxSecure	Trojan.Malware.121218.susgen

How to remove Trojan:Win32/Dridex.NM!MTB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Trojan:Win32/Dridex.NM!MTB” infection