Trojan:Win32/EmotetCrypt.PCM!MTB (file analysis)

The Trojan:Win32/EmotetCrypt.PCM!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/EmotetCrypt.PCM!MTB virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/EmotetCrypt.PCM!MTB?


File Info:
name: 96971B42788638723DAE.mlw
path: /opt/CAPEv2/storage/binaries/00e37b078103a5483ed1291ae003821f4b71764a458c78867dc40691f4c232ed
crc32: 6BEDD306
md5: 96971b42788638723dae491915fd44d8
sha1: 4f1fa06f75b7823784761b02e149ee5c3a6756be
sha256: 00e37b078103a5483ed1291ae003821f4b71764a458c78867dc40691f4c232ed
sha512: d33131c5fee6f244ca45312fadaf1b0ff20ed11d40b786b8b27836a56f58a588662d4ba5164f3d0e02510f4dcc2607ee8b97ad59c75cefad864bdfb7d1a9351d
ssdeep: 192:vvxxsMP0HZvRwDeWMwh1EzG98vEFnEuOu3DN4q4N9n9dwTAkl5Q7onqQGKE/AIGN:vktvRwDF/0GOv0EjuZ4qC9n9uTAUQ7o/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A242C712B2219D17CA231A321F5E1FAF93FCBFB483B07947C38C0E6423E3696951255A
sha3_384: 8f456c7d057730c4c5398c76eacf19f2adb0f0221d55708480e298ac831d964a45015bc6a1382ebd3c6accd4cd4f1567
ep_bytes: 
timestamp: 2020-09-28 22:42:54

Version Info:
0: [No Data]

Trojan:Win32/EmotetCrypt.PCM!MTB also known as:

Bkav	W32.AIDetectMalware
DrWeb	Trojan.DownLoader34.57257
Skyhigh	BehavesLike.Win32.Generic.lm
Sangfor	Trojan.Win32.EmotetCrypt.PCM
Alibaba	Trojan:Win32/EmotetCrypt.9f848148
APEX	Malicious
Rising	Trojan.Kryptik!1.CD0B (CLASSIC)
Google	Detected
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Varist	W32/ABTrojan.DQPF-4901
Microsoft	Trojan:Win32/EmotetCrypt.PCM!MTB
Ikarus	Trojan-Banker.Emotet
MaxSecure	Trojan.Malware.107428801.susgen
Fortinet	MalwThreat!cc15IV
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/EmotetCrypt.PCM!MTB?

Trojan:Win32/EmotetCrypt.PCM!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X