Trojan:Win32/Emotet.BD!MTB removal tips

The Trojan:Win32/Emotet.BD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Emotet.BD!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Mimics the system’s user agent string for its own requests
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Deletes its original binary from disk
• Attempts to remove evidence of file being downloaded from the Internet
• Created a process from a suspicious location
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the Emotet malware family

How to determine Trojan:Win32/Emotet.BD!MTB?

File Info:
name: 3F93A01436BAA2B9D11C.mlw
path: /opt/CAPEv2/storage/binaries/16f2f5f02c808ad6dae40d0db16d3e0468f4f0a86e5a1ad41dbe4cc98cab425b
crc32: 77F61FE1
md5: 3f93a01436baa2b9d11cef40844f0593
sha1: ffbb1cf5160922d74205d9425a60a4aeb07e0103
sha256: 16f2f5f02c808ad6dae40d0db16d3e0468f4f0a86e5a1ad41dbe4cc98cab425b
sha512: f6d251dd4e96aff39d29715188efa1154bb5f4d50df48ff321154dfc14a6c4aa9705770ec73b9ce60c99997910e4ad8e499303270fa8b465d947ac59c29d9f99
ssdeep: 6144:NWNT8cGMDAPeX3fvIwb7Xr/3nnTfvIauc:Et8cGMDWauc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EC24D4C2939C1A8DF87A743590B64841A3A4FED547B1E20B25F9742A14F07EA3C277B7
sha3_384: edfdc3c27562d10bf84e7b78396a8c187bd8a3bf0a49c0940bba4ebe4f16b645025b238d02eb3507ac15f8c24c61dab2
ep_bytes: 558bec83ec14c745f401000000c745f0
timestamp: 2019-09-22 21:40:54

Version Info:
CompanyName: Magneto Software
FileDescription: Global Network Inventory Scanner
FileVersion: 4, 1, 0, 4
InternalName: GNI Scanner
LegalCopyright: Copyright© Magneto Software
OriginalFilename: gniscan.exe
ProductName: Global Network Inventory
ProductVersion: 4, 1, 0, 4
Translation: 0x0409 0x04b0

Trojan:Win32/Emotet.BD!MTB also known as:

How to remove Trojan:Win32/Emotet.BD!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.