Trojan:Win32/Raccrypt.GV!MTB removal tips

The Trojan:Win32/Raccrypt.GV!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Raccrypt.GV!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Manipuri
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Detects Sandboxie through the presence of a library
• Detects Avast Antivirus through the presence of a library
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Checks the presence of disk drives in the registry, possibly for anti-virtualization

How to determine Trojan:Win32/Raccrypt.GV!MTB?

File Info:
name: E8AF53DF78A33C74E0D9.mlw
path: /opt/CAPEv2/storage/binaries/eb4c2cb330f48a5af3862bf58263c88d1968406efe3f64aaa642d9b744e0b028
crc32: 12BC2735
md5: e8af53df78a33c74e0d96924c9cbe9c7
sha1: 34489599f07130c4adbe1cd040fd035a6db254f1
sha256: eb4c2cb330f48a5af3862bf58263c88d1968406efe3f64aaa642d9b744e0b028
sha512: d97f24027253d18efaef5052540b49722d187a08123f09af6c35ac552ba980b4f228f97b0c020eee66c38ec8c5ada7159000c03464434313d3cab4d30de9035b
ssdeep: 3072:sW5xhv0qAMDzcOiNfIJUVsmhsJVggjcGkNIVqIbM/h3:fAqAMHRJNr7ITsq0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A5549CE27590D432C0953B3084678EA15E7EFC01DA5086B772B83BAEAF722C1962571F
sha3_384: f4a2526f264d1873ddaf286fbcd8bd05c3ed10048d40f7abde8dd41296329f52cb24c372101a3eb2524428109d2e6149
ep_bytes: e88e450000e978feffffcccccccccccc
timestamp: 2021-06-02 11:20:17

Version Info:
InternationalName: bomgvioci.iwa
Copyright: Copyrighz (C) 2021, fudkort
ProjectVersion: 3.14.72.77
Translation: 0x0129 0x07bc

Trojan:Win32/Raccrypt.GV!MTB also known as:

How to remove Trojan:Win32/Raccrypt.GV!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.