About "Trojan:Win32/Obfuscator.SL!MTB" infection

The Trojan:Win32/Obfuscator.SL!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Obfuscator.SL!MTB virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Arabic (Egypt)
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
Collects information about installed applications
Checks the CPU name from registry, possibly for anti-virtualization
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

sartinecolumbesa.com

ip-api.com

How to determine Trojan:Win32/Obfuscator.SL!MTB?


File Info:
crc32: 61E16F32
md5: 19d9761318f53b16e630c854d7e9d7b6
name: 5.exe
sha1: 244f4f21ce2af263be77e5cd8d097aa496aaafbf
sha256: 53f25cdeac3696be16b1d2167839513ab4ed947490c34371440c336c2e9d4e74
sha512: 24dee44b50f2dd9664c4f69860e5102d7146b4516e1cf9d38938c54ab3e1e47118fb1c40247726d820d988da1024ae09ed6fa34419f4fc55bf113549de929260
ssdeep: 12288:MieWHkPtX5aZsVJ7Y8IdHIdFii+MeCDBuT/kxlc08EzkUAFA:xe118oY8IdHsii+MHD1laCt
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
InternalSurname: edsgkphvesv.ixe
FileVersion: 1.2.0.1
Copyrighd: Copyrighd (C) 2020, odfgbjv
ProductVersion: 1.0.4.4
Translation: 0x0842 0x04c4

Trojan:Win32/Obfuscator.SL!MTB also known as:

Bkav	HW32.Packed.
MicroWorld-eScan	Trojan.GenericKD.43378094
FireEye	Generic.mg.19d9761318f53b16
McAfee	RDN/Generic.grp
Sangfor	Malware
K7AntiVirus	Trojan ( 0053d5971 )
BitDefender	Trojan.GenericKD.43378094
K7GW	Trojan ( 0053d5971 )
Cybereason	malicious.1ce2af
Invincea	heuristic
Symantec	Packed.Generic.525
APEX	Malicious
Avast	Win32:CoinminerX-gen [Trj]
GData	Trojan.GenericKD.43378094
Kaspersky	Trojan.Win32.Chapak.enkq
AegisLab	Adware.Win32.Generic.mCzN
Tencent	Win32.Trojan.Chapak.Ebhp
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
DrWeb	Trojan.Siggen9.44744
TrendMicro	Trojan.Win32.AGENT.THFBDBO
Emsisoft	Trojan.Generic (A)
SentinelOne	DFI – Malicious PE
MAX	malware (ai score=100)
Microsoft	Trojan:Win32/Obfuscator.SL!MTB
Arcabit	Trojan.Generic.D295E5AE
ZoneAlarm	Trojan.Win32.Chapak.enkq
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.MalPe.R341475
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34130.Hq0@aCQIggiG
ALYac	Trojan.GenericKD.43378094
VBA32	Trojan.Propagate
Malwarebytes	Trojan.MalPack.GS
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HEHT
TrendMicro-HouseCall	Trojan.Win32.AGENT.THFBDBO
Rising	Trojan.Kryptik!1.C7FE (CLOUD)
Ikarus	Trojan.Win32.Crypt
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/Kryptik.HEHJ!tr
Ad-Aware	Trojan.GenericKD.43378094
AVG	Win32:CoinminerX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.667

How to remove Trojan:Win32/Obfuscator.SL!MTB?

Trojan:Win32/Obfuscator.SL!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Trojan:Win32/Obfuscator.SL!MTB” infection