Trojan:Win32/Meterpreter.RPZ!MTB malicious file

The Trojan:Win32/Meterpreter.RPZ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Meterpreter.RPZ!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Binary file triggered YARA rule

How to determine Trojan:Win32/Meterpreter.RPZ!MTB?


File Info:
name: 5916C4AF8B19C27831DA.mlw
path: /opt/CAPEv2/storage/binaries/fb04cd22d328aa9574fcac9a66c625d33cd0d781eb77398b7565958c3fe20bf7
crc32: 54E80778
md5: 5916c4af8b19c27831da014967dacb3d
sha1: 5b90ddba1d965e33fdc38259ec3580cb2a760220
sha256: fb04cd22d328aa9574fcac9a66c625d33cd0d781eb77398b7565958c3fe20bf7
sha512: 3b55071673807139cc5cd0bbf7aba1dcf3be66ad88f31af5d6a55929b73476e29e87339d0a3e686b1b0de5d22b977faed45d69d4638971bee0eb2fd996ec5be7
ssdeep: 1536:C/8ivPnqtFy0Q4isD2ISCRGmrBsLSBPIYs86/xLXKMXj:C/XsnRGm8T
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T116A328D7FA96ADA7CA09063E89FA8319233DF7D80B824B034D3875381A575D06ED7247
sha3_384: fc700879fda4dd769df005525acb466203acf60e893b6bf1cb0f4c6b668571189be3245c7ed5fe857afaef1826ea9df6
ep_bytes: c7056460400000000000e961fdffff90
timestamp: 2024-04-01 02:06:01

Version Info:
0: [No Data]

Trojan:Win32/Meterpreter.RPZ!MTB also known as:

Lionic	Trojan.Win32.Marte.4!c
MicroWorld-eScan	Generic.ShellCode.Marte.3.3CED04E9
FireEye	Generic.ShellCode.Marte.3.3CED04E9
Skyhigh	Artemis
ALYac	Generic.ShellCode.Marte.3.3CED04E9
Cylance	unsafe
Zillya	Trojan.Rozena.Win32.214592
Sangfor	HackTool.Win32.Reverse_Bin_v2_5_through_v4_x.uwccg
K7AntiVirus	Trojan ( 005766041 )
Alibaba	Trojan:Win32/CobaltStrike.5c89
K7GW	Trojan ( 005766041 )
CrowdStrike	win/malicious_confidence_70% (D)
Arcabit	Generic.ShellCode.Marte.3.3CED04E9
Symantec	Meterpreter
Elastic	Windows.Trojan.Metasploit
ESET-NOD32	a variant of Win32/Rozena.AZP
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Generic.ShellCode.Marte.3.3CED04E9
Avast	Win32:Meterpreter-C [Trj]
Tencent	Trojan.Win32.Metasploit_heur.16000690
Emsisoft	Generic.ShellCode.Marte.3.3CED04E9 (B)
F-Secure	Trojan:W32/Payload.A
VIPRE	Generic.ShellCode.Marte.3.3CED04E9
TrendMicro	Backdoor.Win32.COBEACON.SMD
Sophos	ATK/Swrort-GA
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.Generic.hqfxa
Antiy-AVL	Trojan/Win32.Rozena
Microsoft	Trojan:Win32/Meterpreter.RPZ!MTB
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Win32.Trojan.PSE.12141ZK
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R596585
McAfee	Artemis!5916C4AF8B19
MAX	malware (ai score=82)
Malwarebytes	Malware.AI.1161759875
Panda	Trj/GdSda.A
Rising	HackTool.Swrort!1.6477 (CLASSIC)
Ikarus	Trojan.Win32.Rozena
Fortinet	W32/Rozena.AZP!tr
AVG	Win32:Meterpreter-C [Trj]
Cybereason	malicious.f8b19c
DeepInstinct	MALICIOUS
alibabacloud	Backdoor:Win/CobaltStrike.reverse.A

How to remove Trojan:Win32/Meterpreter.RPZ!MTB?

Trojan:Win32/Meterpreter.RPZ!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X