Categories: Trojan

Trojan:Win32/Qbot.KVD!MTB removal

The Trojan:Win32/Qbot.KVD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Qbot.KVD!MTB virus can do?

CAPE extracted potentially suspicious content
Drops a binary and executes it
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
CAPE detected the embedded win api malware family
Creates a copy of itself
Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Qbot.KVD!MTB?


File Info:
name: C6783E48051DF2DCD90F.mlwpath: /opt/CAPEv2/storage/binaries/119da888864218f3a76a92bb572f55399b475fb10a7d197fc66030face5f09decrc32: 9E7BB9CFmd5: c6783e48051df2dcd90f0dee2900f103sha1: d2f4b9262f37f0a87215f70e8b4c1438a7ae50c3sha256: 119da888864218f3a76a92bb572f55399b475fb10a7d197fc66030face5f09desha512: 9f001b054b81ba897c7f83bf324f16a7b8b082c687ffe78e63b5ae06612734fafb43b55afedf5f3f49b3fc9e51d2d8551709e51b648cbaaa3621dde36e626086ssdeep: 192:kmtH9eROQIhpKLbuiw5cih2biDlh4dT1sCUU3LVfWxbeoLbBCHzrlLXXkeVwd:zaOQapKHI5nv74dpUWVfWxxnitXXktype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10A920748A6657D72E0974AB4456DF1439826BF3106233F537E816A0C9AF0CE38F76B27sha3_384: 0126aa005609e3967015406b273a86ddb68798f44563b69f9de56908f352d2484b58ca0b80cc2cf5c880ecf8227e9beaep_bytes: 558bec6a0aff1510104000506a006a00timestamp: 2011-03-02 07:50:41
Version Info:
CompanyName: ydNFbpoPFileDescription: ySBJhIinAHFileVersion: 0,9,1,3InternalName: SCRCZwZJALegalCopyright: © PPgZZlnE 2005-2009. All rights reserved.OriginalFilename: VXOdQJv.exeProductName: MhaZrfxjProductVersion: 0,9,1,3Translation: 0x0409 0x04e4

Trojan:Win32/Qbot.KVD!MTB also known as:

Lionic	Trojan.Win32.Lexip.lhSE
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Downloader.84
ClamAV	Win.Trojan.Agent-1160895
FireEye	Generic.mg.c6783e48051df2dc
CAT-QuickHeal	Trojan.Dynamer.9215
Skyhigh	GenericRXGU-OQ!C6783E48051D
McAfee	GenericRXGU-OQ!C6783E48051D
Malwarebytes	Generic.Malware/Suspicious
Sangfor	Downloader.Win32.Qbot.V61w
K7AntiVirus	Trojan ( 002122681 )
Alibaba	Trojan:Win32/Kryptik.630f919c
K7GW	Trojan ( 002122681 )
BitDefenderTheta	Gen:NN.ZexaF.36744.bi0@aSBsQcci
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.AJVO
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Downloader.84
NANO-Antivirus	Trojan.Win32.Kryptik.dwnssl
Avast	Win32:Lexip [Wrm]
Tencent	Win32.Trojan.Generic.Hjgl
Emsisoft	Gen:Variant.Downloader.84 (B)
F-Secure	Trojan.TR/Dropper.Gen2
DrWeb	Trojan.DownLoad2.39002
VIPRE	Gen:Variant.Downloader.84
TrendMicro	TROJ_KRYPTIK.SM9
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
Ikarus	Gen.Variant.Downloader
GData	Gen:Variant.Downloader.84
Jiangmin	Trojan/Lexip.aff
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/Dropper.Gen2
Antiy-AVL	Trojan/Win32.Unknown
Kingsoft	Win32.Trojan.Generic.a
Xcitium	TrojWare.Win32.Kryptik.JRE@2y7ev6
Arcabit	Trojan.Downloader.84
ViRobot	Trojan.Win32.S.Lexip.20480.HG
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Qbot.KVD!MTB
Varist	W32/Downloader.CK.gen!Eldorado
AhnLab-V3	Trojan/Win32.Lexip.R34997
VBA32	BScope.Trojan.Downloader
ALYac	Gen:Variant.Downloader.84
MAX	malware (ai score=100)
Cylance	unsafe
Panda	Trj/Downloader.YDP
TrendMicro-HouseCall	TROJ_KRYPTIK.SM9
Rising	Trojan.Qbot!8.8A3 (TFE:4:vqzsKyrTBpN)
Yandex	Trojan.GenAsa!Io8F0LthYmU
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Lexip.HK!tr
AVG	Win32:Lexip [Wrm]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)