Trojan

Should I remove “Trojan:Win32/EmotetCrypt!rfn”?

Malware Removal

The Trojan:Win32/EmotetCrypt!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan:Win32/EmotetCrypt!rfn virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Mimics the system’s user agent string for its own requests
  • Expresses interest in specific running processes
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Attempts to modify proxy settings

How to determine Trojan:Win32/EmotetCrypt!rfn?


File Info:

crc32: ADAB602F
md5: aead64a4fdfaa8e2813018ee55fafa62
name: upload_file
sha1: c7f6be73b6b3608b7d472ad614c32ace8d0fab25
sha256: bae3cb7a06edf85b09caf5c233096296da2f628993416ad23c508abf4a642001
sha512: e5787cd1d2a395c76dd63eead6974d0cfb8a84348aadd31f32ec1abbadbab766a9154f9e0fcd3eeba7c4905a010ab809b3a9869ddeb357a7a43852801faa32a3
ssdeep: 6144:4abhDkzV+z3ItUUiCFYcK/7X0XfGkDmrDI3U4KFzq+EP78YaAy2+1Oo:4YhozVKIixT7XFPc3RixEP7Z
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: TODO: (c) . All rights reserved.
InternalName: WebPageSnapShot.exe
FileVersion: 1.0.0.1
CompanyName: TODO:
ProductName: TODO:
ProductVersion: 1.0.0.1
FileDescription: TODO:
OriginalFilename: WebPageSnapShot.exe
Translation: 0x0409 0x04e4

Trojan:Win32/EmotetCrypt!rfn also known as:

BkavW32.EmotetNTR.Trojan
DrWebTrojan.DownLoader34.53409
MicroWorld-eScanTrojan.Agent.EXAR
FireEyeTrojan.Agent.EXAR
ALYacTrojan.Agent.Emotet
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
AegisLabTrojan.Win32.Emotet.L!c
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.Agent.EXAR
K7GWRiskware ( 0040eff71 )
TrendMicroTROJ_GEN.R002C0DIS20
CyrenW32/Emotet.EJVS-5757
SymantecTrojan.Emotet
APEXMalicious
AvastWin32:Trojan-gen
KasperskyHEUR:Trojan-Banker.Win32.Emotet.pef
AlibabaTrojan:Win32/Emotet.833b0d7c
ViRobotTrojan.Win32.Z.Emoteto.434176.AYY
TencentMalware.Win32.Gencirc.10ce061e
Ad-AwareTrojan.Agent.EXAR
TACHYONTrojan/W32.Agent.434176.YJ
SophosTroj/Emotet-CPH
F-SecureTrojan.TR/AD.Emotet.ukflj
ZillyaTrojan.Emotet.Win32.32298
InvinceaMal/Generic-R + Troj/Emotet-CPH
McAfee-GW-EditionEmotet-FSF!AEAD64A4FDFA
EmsisoftTrojan.Emotet (A)
IkarusTrojan-Banker.Emotet
JiangminTrojan.Banker.Emotet.org
AviraTR/AD.Emotet.ukflj
Antiy-AVLTrojan[Banker]/Win32.Emotet
MicrosoftTrojan:Win32/EmotetCrypt!rfn
ArcabitTrojan.Agent.EXAR
ZoneAlarmHEUR:Trojan-Banker.Win32.Emotet.pef
GDataTrojan.Agent.EXAR
AhnLab-V3Malware/Win32.Generic.C4199919
McAfeeEmotet-FSF!AEAD64A4FDFA
MAXmalware (ai score=99)
VBA32BScope.Trojan.Zenpak
MalwarebytesTrojan.MalPack.TRE
PandaTrj/Genetic.gen
ESET-NOD32Win32/Emotet.CB
TrendMicro-HouseCallTROJ_GEN.R002C0DIS20
RisingTrojan.Kryptik!1.CC98 (CLASSIC)
MaxSecureTrojan.Malware.11417434.susgen
FortinetW32/Emotet.1029!tr
AVGWin32:Trojan-gen
Paloaltogeneric.ml
Qihoo-360Win32/Trojan.095

How to remove Trojan:Win32/EmotetCrypt!rfn?

Trojan:Win32/EmotetCrypt!rfn removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment