Trojan:Win32/Formbook.RPX!MTB (file analysis)

The Trojan:Win32/Formbook.RPX!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Formbook.RPX!MTB virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid

How to determine Trojan:Win32/Formbook.RPX!MTB?


File Info:
name: 64DC25CCB4D02AA54629.mlw
path: /opt/CAPEv2/storage/binaries/6449b6aada4ba64295fcbf0a1e8710066014942f53fac5ae8de30fe4b6b622fe
crc32: 6C064FC9
md5: 64dc25ccb4d02aa54629dd4291cb0628
sha1: 5e5a3c6560a0b0178eb9f1a590cb1e075cf7b2ba
sha256: 6449b6aada4ba64295fcbf0a1e8710066014942f53fac5ae8de30fe4b6b622fe
sha512: a7e9715cc2ec0c44292e1e73b094969c90f84fbbd6cf7aeed3cf4c66a32b39ed20fcea5c058cc7c08099270e1864ffc92bc0d2f30bec1e07d69df1c844220b97
ssdeep: 12288:/sqfM+3mvvfez01NLCPyUV4U3rEuGaY6Z://fM9v3gALCB4U3AaY4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D0942352C2D784F7C84AADB04EBDB798EF350D240321770A8FF86DAB5A212D7DD44616
sha3_384: 72b51bc3e9c67d7525625816b043592bb5a10b35e9a1fa9e7b25a9c8a1b1c7117370d6a8426c2440578669582b62914d
ep_bytes: 81ec840100005355565733db68018000
timestamp: 2016-04-02 03:20:13

Version Info:
0: [No Data]

Trojan:Win32/Formbook.RPX!MTB also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.NSISX.Spy.Gen.24
Skyhigh	BehavesLike.Win32.Generic.gc
ALYac	Trojan.NSISX.Spy.Gen.24
VIPRE	Trojan.NSISX.Spy.Gen.24
BitDefender	Trojan.NSISX.Spy.Gen.24
Cybereason	malicious.560a0b
BitDefenderTheta	Gen:NN.ZexaF.36792.pyW@aqL9EXl
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ETLA
APEX	Malicious
Kaspersky	Trojan.Win32.Strab.dja
Rising	Trojan.Formbook!8.F858 (TFE:5:OXVMaIszf5L)
F-Secure	Trojan.TR/Injector.tdbfg
FireEye	Generic.mg.64dc25ccb4d02aa5
Emsisoft	Trojan.NSISX.Spy.Gen.24 (B)
Ikarus	Trojan.Win32.Injector
Google	Detected
Avira	TR/Injector.tdbfg
Varist	W32/Noon.AE.gen!Eldorado
Microsoft	Trojan:Win32/Formbook.RPX!MTB
Arcabit	Trojan.NSISX.Spy.Gen.24 [many]
ZoneAlarm	Trojan.Win32.Strab.dja
GData	Trojan.NSISX.Spy.Gen.24
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.MalwareX-gen.R619956
MAX	malware (ai score=82)
DeepInstinct	MALICIOUS
SentinelOne	Static AI – Suspicious PE
Fortinet	NSIS/Agent.DCAC!tr
AVG	Win32:PWSX-gen [Trj]
Avast	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_60% (D)

How to remove Trojan:Win32/Formbook.RPX!MTB?

Trojan:Win32/Formbook.RPX!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X