What is “Trojan:Win32/Emotet.RS!MSR”?

The Trojan:Win32/Emotet.RS!MSR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Emotet.RS!MSR virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Uses Windows utilities for basic functionality
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• A scripting utility was executed
• Attempts to identify installed AV products by registry key
• Attempts to disable Windows Defender
• Attempts to modify Windows Defender using PowerShell
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Emotet.RS!MSR?

File Info:
name: 24F1808824F5E7213667.mlw
path: /opt/CAPEv2/storage/binaries/cf6b021c263b08c79abb92218dc6130bf20ef9b7eea3f7a45f57209b9f1f7518
crc32: 695311B1
md5: 24f1808824f5e7213667b35b080d6b91
sha1: e5af64557f7f083f0a60b07addcfd5b0f0ae55ca
sha256: cf6b021c263b08c79abb92218dc6130bf20ef9b7eea3f7a45f57209b9f1f7518
sha512: 1b71145ca4a8ab7b97c458b0f36d2ad2aa346ee180bef8b72d74ca3836d1b58db8b6144aec24698eeadcc0f5b67413e5d6412f12c14800d703158bf8d989289e
ssdeep: 1536:fVjmaVlKRWjEom0ummb5MiwL/mb5MAzbypbO8PXTGOPQ+ws5Ao0qTi:fVjRoAEo7szby7ws5Ao0qTi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T194846343BF890FC7D21A55B84447A612785FCD656B07EE97D2203B2A2D7C2B7A1E309C
sha3_384: 4e1280ebad4a77d091060571342495b1f68f9f9cf12269bf8d72245da770a8b3b2e56e76adca7477bfb3debac240a7dc
ep_bytes: e8f4150000e978feffff8bff558bec8b
timestamp: 2019-11-05 17:48:12

Version Info:
0: [No Data]

Trojan:Win32/Emotet.RS!MSR also known as:

How to remove Trojan:Win32/Emotet.RS!MSR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.