Categories: Trojan

Trojan:Win32/Gozi.RD!MTB removal guide

The Trojan:Win32/Gozi.RD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Gozi.RD!MTB virus can do?

Behavioural detection: Executable code extraction – unpacking
Uses Windows utilities for basic functionality
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses suspicious command line tools or Windows utilities

How to determine Trojan:Win32/Gozi.RD!MTB?


File Info:
name: F709C6B66030595D3F65.mlwpath: /opt/CAPEv2/storage/binaries/3ad09ab7fc27b466d6be897db94589ea618b8a4dd1e8f08d1b6cdc0750e1c164crc32: DAD314F2md5: f709c6b66030595d3f65e049bbd1dd4fsha1: bf1533ffbaf3813dbafb344fb26f9fce8af98423sha256: 3ad09ab7fc27b466d6be897db94589ea618b8a4dd1e8f08d1b6cdc0750e1c164sha512: d8ccb6e88b1aa643fc406488992148dd8b23546e9a0e31b016963626cfd6e6c1a21f397214d79713bbdc9cabe2e6b3649f703cf1d751f5e874ef5a9f317c7fb1ssdeep: 3072:M/047M+14BEHzWqgUfPNrXuSKp18z2Odknu+vmmWBuxBl11cRQycLRbpgjDD2ruI:SwhBEHzWpUfPNr+DRD5fWBuxBl11tbpCtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11B041345D54C5D31CFBC83B62439DC393ED1A02579BC4067AE9C8BA5FB648487EDE680sha3_384: 603f8c929a767dfe9f94972bacd586d38e933ebad8c9e5046ab2e03889036e159ab7526e39602053c46792a5181028e7ep_bytes: ff1528e04200a300f04200e8ddfdfffftimestamp: 2022-11-08 00:43:57
Version Info:
0: [No Data]

Trojan:Win32/Gozi.RD!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Virus.Win32.PolyRansom.tsto
DrWeb	Trojan.Inject1.53764
MicroWorld-eScan	Win32.Doboc.Gen.1
FireEye	Generic.mg.f709c6b66030595d
CAT-QuickHeal	Trojan.Mauvaise.SL1
Skyhigh	BehavesLike.Win32.DocumentCrypt.cc
ALYac	Win32.Doboc.Gen.1
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0040fa661 )
BitDefender	Win32.Doboc.Gen.1
K7GW	Trojan ( 0040fa661 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Win32.Doboc.Gen.1
BitDefenderTheta	AI:FileInfector.1210116D11
VirIT	Trojan.Win32.Agent_r.CAE
Symantec	W32.Tempedreve.F!inf
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.DAZG
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Virus.Win32.PolyRansom.c
Alibaba	Ransom:Win32/PolyRansom.fd9
NANO-Antivirus	Trojan.Win32.PolyRansom.dpzfcr
ViRobot	Win32.Ursnif.A
Rising	Virus.Tuscas!1.D799 (CLASSIC)
Sophos	W32/MPhage-B
F-Secure	Trojan.TR/Crypt.ZPACK.Gen
Baidu	Win32.Trojan.Kryptik.iq
VIPRE	Win32.Doboc.Gen.1
TrendMicro	PE_URSNIF.E-O
Trapmine	malicious.high.ml.score
Emsisoft	Win32.Doboc.Gen.1 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Virus.PolyRansom.ec
Webroot	W32.Trojan.Ursnif
Google	Detected
Avira	TR/Crypt.ZPACK.Gen
MAX	malware (ai score=84)
Antiy-AVL	Virus/Win32.PolyRansom.c
Kingsoft	malware.kb.a.1000
Xcitium	TrojWare.Win32.Ursnif.KIL@5jjifs
Microsoft	Trojan:Win32/Gozi.RD!MTB
ZoneAlarm	Virus.Win32.PolyRansom.c
GData	Win32.Trojan.PSE.10D3T6U
Varist	W32/Virus.FQFG-3191
AhnLab-V3	Trojan/Win32.Ursnif.R239873
McAfee	Trojan-FGBQ!F709C6B66030
TACHYON	Trojan/W32.Doboc
DeepInstinct	MALICIOUS
VBA32	SScope.Trojan.FakeAV.01681
Malwarebytes	Generic.Malware.AI.DDS
Panda	W32/CryptD.C
TrendMicro-HouseCall	PE_URSNIF.E-O
Tencent	Trojan.Win32.Tuscas.a
Yandex	Trojan.GenAsa!RK3x+npEgzs
Ikarus	Trojan-Ransom.Locky
Fortinet	W32/Generic.AC.788!tr
AVG	Win32:WormX-gen [Wrm]
Cybereason	malicious.fbaf38
Avast	Win32:WormX-gen [Wrm]