Trojan:Win32/Raccoon.RI!MTB removal

The Trojan:Win32/Raccoon.RI!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Raccoon.RI!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Georgian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks the presence of disk drives in the registry, possibly for anti-virtualization

How to determine Trojan:Win32/Raccoon.RI!MTB?

File Info:
name: 5C443D1198FA7AF221F9.mlw
path: /opt/CAPEv2/storage/binaries/f17a6d447a92af88d6751f68cfbd3a5bbe3c56a2fd5652840a925f45b5cdea7b
crc32: 5DBE9A88
md5: 5c443d1198fa7af221f98de3f738d77d
sha1: efd41ef6812022f0f814aa2648daaf6507686941
sha256: f17a6d447a92af88d6751f68cfbd3a5bbe3c56a2fd5652840a925f45b5cdea7b
sha512: d207b5fae50fdc8e0c9af0ec36b754c549f384787ac64cd7ccebe6e5f54151d406a909a99269d235acd9ebd59db5f3e301bf8a1b6020414d7f3ea6dcf66f6793
ssdeep: 6144:r1KLsNoBBJ0dLV8otyqMbmuzbgwu75kxrwVfc:r8mkB4LKyxunnLZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12B44BD3136EAC8F1F2A315704864DBA06B3FB8326570954B2B14265E1E72EDC96F631F
sha3_384: b4d688033276a910c1e1460dae14fbe2181e8b9e909caac45a3b4373c514f4d5d4413382733c0989a1e2555baf89e970
ep_bytes: e8bf600000e979feffffcccccccccc8b
timestamp: 2021-05-12 18:59:52

Version Info:
FileVersions: 12.32.9.87
InternationalName: povgwaoci.iwe
Copyright: Copyright (C) 2022, somoklos
ProjectVersion: 82.42.46.96

Trojan:Win32/Raccoon.RI!MTB also known as:

How to remove Trojan:Win32/Raccoon.RI!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.