Should I remove “Trojan:Win32/Raccoon.RB!MTB”?

The Trojan:Win32/Raccoon.RB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Raccoon.RB!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Kannada
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the RedLine malware family
• Anomalous binary characteristics

How to determine Trojan:Win32/Raccoon.RB!MTB?

File Info:
name: 855D580120EE0C93D728.mlw
path: /opt/CAPEv2/storage/binaries/b95b7d350cf6eeea465158f189adfc1036b6bf10526c53298c2748947dbff12f
crc32: 7C793629
md5: 855d580120ee0c93d7288624186a32cf
sha1: f0ed7ac72b94e66bc06aa156809aea5d22ac1e57
sha256: b95b7d350cf6eeea465158f189adfc1036b6bf10526c53298c2748947dbff12f
sha512: e4ed02369f1b79778dc219fdaf558fbb150d3eceb2d7c6ea4a7b1344f91b79b04019fb9174e0841ed99cff431278c96f755643bf7537d04c80fce775989eb472
ssdeep: 6144:OiEfQ9XiQe18wyDNlSM+jsttFIxsKYW6dJdbs3vF:OrQ5NIM+4fHRWYdb6N
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13754F1123BB1C832F9A71A7090B5C7A25B3A7D132AB1454B3764273FAF617C16A7431B
sha3_384: 7cb278f8593a22e6b5416e0818c24287970daa1118ec9f8cb3c3a4712974f9fe9eb37f4330ec3d329f213cb926028ec2
ep_bytes: e894460000e989feffffcccccccccccc
timestamp: 2021-10-30 09:47:36

Version Info:
FileVersions: 48.90.12.32
Copyrighz: Copyright (C) 2022, pozkarte
ProjectVersion: 84.64.75.52

Trojan:Win32/Raccoon.RB!MTB also known as:

How to remove Trojan:Win32/Raccoon.RB!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.