Trojan:Win32/Glupteba.MP!MTB (file analysis)

The Trojan:Win32/Glupteba.MP!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Glupteba.MP!MTB virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Unconventionial language used in binary resources: Norwegian (Nynorsk)
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Glupteba.MP!MTB?


File Info:
crc32: FC980EEA
md5: bd6f7af67675aebcb1b0c2684fe78f58
name: BD6F7AF67675AEBCB1B0C2684FE78F58.mlw
sha1: f7821df524c9579d8b3dec5c70677581ac4a952e
sha256: d805d93d8efe115835c6c8640b366090f00501fb2397aac7c550479f54f84014
sha512: 162f6351876d42aa85a346aec9529ea6305c992a6ada0ce7010af6fbddb414cba91950efad9904dfcd1d83bfac3db379676234d02fbf813b3aae1a4ab7d8deec
ssdeep: 6144:BLG0xdr+TOMD29NAlx5kXoHrMjp0SJJGCM:BK4d6TOMS+H8481J
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
InternalName: driveapoges.ots
FileVers: 26.26.361
Copyright: Copyrighz (C) 2020, pepkafug
TranslationUsa: 0x0571 0x0180

Trojan:Win32/Glupteba.MP!MTB also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.26952
MicroWorld-eScan	Trojan.Mint.Jamg.C
CAT-QuickHeal	Backdoor.Tofsee
Qihoo-360	Win32/Backdoor.968
ALYac	Trojan.Agent.Amadey
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Tofsee.m!c
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Trojan.Mint.Jamg.C
K7GW	Trojan ( 00573e301 )
K7AntiVirus	Trojan ( 00573e301 )
Cyren	W32/Trojan.IADN-2157
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
Kaspersky	HEUR:Backdoor.Win32.Tofsee.gen
Alibaba	Trojan:Win32/Glupteba.41b2b8df
ViRobot	Trojan.Win32.Z.Zusy.336896.Q
Tencent	Win32.Backdoor.Tofsee.Phql
Ad-Aware	Trojan.Mint.Jamg.C
Emsisoft	Trojan.Mint.Jamg.C (B)
Comodo	Malware@#28javkrtr7egg
F-Secure	Heuristic.HEUR/AGEN.1139509
Zillya	Backdoor.Tofsee.Win32.4006
TrendMicro	Trojan.Win32.GLUPTEBA.THLODBO
McAfee-GW-Edition	BehavesLike.Win32.Generic.fm
FireEye	Generic.mg.bd6f7af67675aebc
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.Agent.czuv
Avira	HEUR/AGEN.1139509
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Glupteba.MP!MTB
Gridinsoft	Trojan.Heur!.02014021
Arcabit	Trojan.Mint.Jamg.C
ZoneAlarm	HEUR:Backdoor.Win32.Tofsee.gen
GData	Trojan.Mint.Jamg.C
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Glupteba.R356808
Acronis	suspicious
McAfee	Packed-GCZ!BD6F7AF67675
MAX	malware (ai score=85)
VBA32	BScope.Exploit.Shellcode
Malwarebytes	Trojan.MalPack.GS
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HHUR
TrendMicro-HouseCall	Trojan.Win32.GLUPTEBA.THLODBO
Rising	Trojan.Kryptik!1.CF77 (CLASSIC)
Ikarus	Trojan.Dropper
eGambit	Unsafe.AI_Score_62%
Fortinet	W32/Kryptik.HHUN!tr
AVG	Win32:DropperX-gen [Drp]
Cybereason	malicious.524c95
Paloalto	generic.ml
MaxSecure	Trojan.Malware.300983.susgen

How to remove Trojan:Win32/Glupteba.MP!MTB?

Trojan:Win32/Glupteba.MP!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Glupteba.MP!MTB (file analysis)