How to remove “Trojan:Win32/Qbot.SM!MTB”?

The Trojan:Win32/Qbot.SM!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Qbot.SM!MTB virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Anomalous binary characteristics

How to determine Trojan:Win32/Qbot.SM!MTB?


File Info:
crc32: D811D534
md5: 9c0c1b224cd60f4963f09f23f9c34908
name: 9C0C1B224CD60F4963F09F23F9C34908.mlw
sha1: 7af6c596ae81fd286a8e89130253bd967ae8803b
sha256: a9cebd30aa2bfe6baf18fea10c7484e3dbbeec4be79d398e02f9ae6802b1afd9
sha512: 8665e556231801faf8bf93bc593ef1b3448574ac5a6b300ba60b48524b71f30fffa285d833dc46b83567239974cd3b8e14da1a17b1f915b03fb66c3b26bb9bdc
ssdeep: 6144:o4thSUHz9HRg1c5Fm0Dq7VTu0Cdvm2MU3Iv7HCuqBl9scWBJe:Ph3Hz9HeWFJDmV61AXuu6D
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: rekeywiz
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.1.7600.16385
FileDescription: EFS REKEY wizard
OriginalFilename: rekeywiz.exe
Translation: 0x0409 0x04b0

Trojan:Win32/Qbot.SM!MTB also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Mint.Zamg.O
FireEye	Generic.mg.9c0c1b224cd60f49
McAfee	GenericRXAA-AA!9C0C1B224CD6
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Backdoor ( 0056d6b31 )
BitDefender	Trojan.Mint.Zamg.O
K7GW	Backdoor ( 0056d6b31 )
Cybereason	malicious.24cd60
Cyren	W32/RTM.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Packed.Qbot-9757365-0
Kaspersky	HEUR:Trojan.Win32.Bsymem.pef
Tencent	Malware.Win32.Gencirc.10ce13b7
Ad-Aware	Trojan.Mint.Zamg.O
Emsisoft	MalCert.A (A)
F-Secure	Trojan.TR/Crypt.ZPACK.Gen4
DrWeb	Trojan.Inject4.4752
Invincea	Troj/Agent-AJFK
Sophos	Troj/Agent-AJFK
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Bsymem.afm
MaxSecure	Trojan.Malware.121218.susgen
Avira	TR/Crypt.ZPACK.Gen4
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Qbot.SM!MTB
Gridinsoft	Trojan.Win32.Kryptik.oa!s4
Arcabit	Trojan.Mint.Zamg.O
ZoneAlarm	HEUR:Trojan.Win32.Bsymem.pef
GData	Trojan.Mint.Zamg.O
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Banki.R350674
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34634.@t1@aOerhIdi
ALYac	Trojan.Mint.Zamg.O
MAX	malware (ai score=85)
VBA32	BScope.Malware-Cryptor.SB.01798
Malwarebytes	Backdoor.Qbot
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Kryptik.HGAQ
Rising	Trojan.Kryptik!1.CE9B (CLASSIC)
Ikarus	Trojan.Win32.CryptInject
eGambit	PE.Heur.InvalidSig
AVG	Win32:DangerousSig [Trj]
Avast	Win32:DangerousSig [Trj]
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM20.1.44A7.Malware.Gen

How to remove Trojan:Win32/Qbot.SM!MTB?

Trojan:Win32/Qbot.SM!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X