Trojan:Win32/Injector.YB!bit malicious file

The Trojan:Win32/Injector.YB!bit is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Injector.YB!bit virus can do?

Sample contains Overlay data
Authenticode signature is invalid

How to determine Trojan:Win32/Injector.YB!bit?


File Info:
name: D6F81CBB2F0D5EBF2113.mlw
path: /opt/CAPEv2/storage/binaries/9bca0e3d58510e28c1d8a9320cbd8601cdce753a1b80b51f3fd1b365d25319c7
crc32: C2FD9937
md5: d6f81cbb2f0d5ebf21132935c4e1b26c
sha1: 140025174b114a37148f3fc4d7320cdbbe34acf9
sha256: 9bca0e3d58510e28c1d8a9320cbd8601cdce753a1b80b51f3fd1b365d25319c7
sha512: 4bce7051d8a74af318ad7c5bf97c6c8d19c0631780206ff9208826d2853750bb6304e1004598f576c29be97aa600c80f70d2ec19668a2c702f86f1a096b1339b
ssdeep: 49152:LO4mO4Fpl4zOph7GBfWSH8s+V8tgJd8EHzqCkppYq5:LO4mO4VOO77GBfWJs+CgaAz1kp6s
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T16D061803E3914063F0622570CC66AB6446737EB56E36D2BBEE427619BE72BC34432776
sha3_384: e02895bbf04ab1818e0b5d2ce75349ed092a76adae760cad529f5744a0096a4f41c36b922f90638a4d5b5f7b5bf556b1
ep_bytes: 6a2868606c4000e87502000033ff57ff
timestamp: 2006-11-29 09:25:22

Version Info:
CompanyName: Sun Microsystems, Inc.
FileDescription: Java(TM) Platform SE binary
FileVersion: 6.0.0.105
Full Version: 1.6.0-b105
InternalName: pack200
LegalCopyright: Copyright © 2004
OriginalFilename: pack200.exe
ProductName: Java(TM) Platform SE 6
ProductVersion: 6.0.0.105
Translation: 0x0000 0x04b0

Trojan:Win32/Injector.YB!bit also known as:

Bkav	W32.AIDetect.malware1
tehtris	Generic.Malware
MicroWorld-eScan	Win32.Autorun.AHY
FireEye	Generic.mg.d6f81cbb2f0d5ebf
CAT-QuickHeal	Trojan.Quolko.A
McAfee	PWS-Zbot.gen.di
Cylance	Unsafe
Zillya	Backdoor.Spammy.Win32.77
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Virus ( 005386151 )
K7GW	Virus ( 005386151 )
CrowdStrike	win/malicious_confidence_60% (D)
BitDefenderTheta	AI:Packer.AA1E30121F
Cyren	W32/Ramnit.F.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Ramnit.A
Baidu	Win32.Backdoor.Agent.ac
TrendMicro-HouseCall	TROJ_SPAMMY_0000000.TOMA
ClamAV	Win.Trojan.Spammy-1
Kaspersky	VHO:Backdoor.Win32.Spammy.gen
BitDefender	Win32.Autorun.AHY
NANO-Antivirus	Trojan.Win32.Spammy.cstqfi
Cynet	Malicious (score: 100)
Avast	Win32:MalOb-FE [Cryp]
Ad-Aware	Win32.Autorun.AHY
Sophos	Generic ML PUA (PUA)
Comodo	Backdoor.Win32.Spammy.GFF@37eb84
DrWeb	Trojan.MulDrop3.61
VIPRE	Win32.Autorun.AHY
TrendMicro	TROJ_SPAMMY_0000000.TOMA
McAfee-GW-Edition	BehavesLike.Win32.Generic.wh
SentinelOne	Static AI – Malicious PE
Emsisoft	Win32.Autorun.AHY (B)
APEX	Malicious
GData	Trojan.Generic.KD.111744
Avira	TR/Patched.Ren.Gen
MAX	malware (ai score=80)
Arcabit	Win32.Autorun.AHY
Microsoft	Trojan:Win32/Injector.YB!bit
Google	Detected
VBA32	Malware-Cryptor.Win32.General.4
ALYac	Win32.Autorun.AHY
Malwarebytes	Malware.AI.3951108544
Rising	Malware.OBFrag!1.9DEA (CLASSIC)
Yandex	Trojan.GenAsa!jTWp3KgAmEE
Ikarus	Virus.Win32.Ramnit
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W64/Agent.4624!tr
AVG	Win32:MalOb-FE [Cryp]
Cybereason	malicious.b2f0d5

How to remove Trojan:Win32/Injector.YB!bit?

Trojan:Win32/Injector.YB!bit removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X