Trojan:Win32/Emotet.BF!MTB (file analysis)

The Trojan:Win32/Emotet.BF!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Emotet.BF!MTB virus can do?

Executable code extraction
Creates RWX memory
Attempts to repeatedly call a single API many times in order to delay analysis time

Related domains:

z.whorecord.xyz

a.tomx.xyz

help.twitter.com

www.intel.com

How to determine Trojan:Win32/Emotet.BF!MTB?


File Info:
crc32: 98A191CB
md5: 6f83716665bcc8c7c0b4c663f1689457
name: ldr_3341780230_karantino.xyz.exe
sha1: 1cb047cbfb07fe10e567da52d0279409caf3e730
sha256: adb411fdd3bcaf4dfa813c10a6cc4836332e57fa8ef21af6df1d2bb5517df819
sha512: 9f0c409f552c9fb24cc4776cfa7760db7348fa601ba021921ffdfea0813586c9566299b4c79d63b2179c3b8eca074c79d2a024af27e4594532378f1c12cec1da
ssdeep: 6144:fFtHf8fKP+irxXmTH5sGA0sq9oLCgArdMf/:ttHf/PLrxXi5sGA0sqa1cdMH
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2000-2004 Hans Dietrich
FileVersion: 1, 2, 0, 1
ProductName: XBitArrayTest
E-mail: hdietrich2@hotmail.com
ProductVersion: 1, 2, 0, 1
FileDescription: XBitArrayTest.exe
OriginalFilename: XBitArrayTest.exe
Translation: 0x0409 0x04b0

Trojan:Win32/Emotet.BF!MTB also known as:

MicroWorld-eScan	Gen:Variant.Ser.Johnnie.4946
McAfee	Artemis!6F83716665BC
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
BitDefender	Gen:Variant.Ser.Johnnie.4946
K7GW	Trojan ( 005634b51 )
K7AntiVirus	Trojan ( 005634b51 )
TrendMicro	TROJ_GEN.R011C0DCQ20
Cyren	W32/Trojan.XTOO-4042
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
GData	Gen:Variant.Ser.Johnnie.4946
Kaspersky	Trojan.Win32.Lolopak.cqa
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ad-Aware	Gen:Variant.Ser.Johnnie.4946
Sophos	Mal/Generic-S
Comodo	Malware@#1d0839hthqomm
F-Secure	Trojan.TR/AD.PhotoDlder.rcdix
McAfee-GW-Edition	RDN/PWS-Banker
Emsisoft	Trojan.Emotet (A)
Ikarus	Trojan.Win32.Crypt
Avira	TR/AD.PhotoDlder.rcdix
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Wacatac
Arcabit	Trojan.Ser.Johnnie.D1352
ZoneAlarm	Trojan.Win32.Lolopak.cqa
Microsoft	Trojan:Win32/Emotet.BF!MTB
AhnLab-V3	Malware/Win32.RL_Generic.R330302
VBA32	Trojan.Sonbokli
ALYac	Trojan.Agent.Lolopak
Malwarebytes	Trojan.MalPack
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HCFS
TrendMicro-HouseCall	TROJ_GEN.R011C0DCQ20
Tencent	Win32.Trojan.Lolopak.Wskh
Fortinet	W32/Kryptik.HCFS!tr
Webroot	W32.Trojan.Gen
AVG	Win32:BankerX-gen [Trj]
Qihoo-360	Win32/Trojan.553

How to remove Trojan:Win32/Emotet.BF!MTB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Emotet.BF!MTB (file analysis)