Trojan:Win32/Ranumbot.RD!MTB removal tips

The Trojan:Win32/Ranumbot.RD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ranumbot.RD!MTB virus can do?

Executable code extraction
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
A process attempted to delay the analysis task.
Expresses interest in specific running processes
Unconventionial language used in binary resources: Ukrainian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Attempts to repeatedly call a single API many times in order to delay analysis time
Checks the CPU name from registry, possibly for anti-virtualization
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Ranumbot.RD!MTB?


File Info:
crc32: D803BDA0
md5: f46abc9ad76838b5836baaca6d0d8d42
name: F46ABC9AD76838B5836BAACA6D0D8D42.mlw
sha1: 93fc2cef4890870e2b204ba4a19ba03b6b0fb156
sha256: 4cabb71bb466985bbbbe8f4460e08ba724d55b208ce21808d667ab4861de4203
sha512: d9041599d014d2c337d35281de64989418275af8ab74b0971d709e5bbcc40a9e4b7b94e73c4e90f76de6fe00389e1753d8a4b2a355c88b111cf73ded6dc78fd2
ssdeep: 98304:1+uzfLZemfKP5OsjS61S0EpaERncCvT8ba8yxSuFZ/WuzldfAj7vDHFhtFZgNlm:6t/1SlU8vT8+LTML3qoHcue02XN3gWD
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
InternalSurname: vebug.ekc
Prod: 1.3.5
FileVersions: 1.0.5.9
LegalCo: Copyri (C) 2019, pidmudakionca

Trojan:Win32/Ranumbot.RD!MTB also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.45546890
FireEye	Generic.mg.f46abc9ad76838b5
ALYac	Trojan.GenericKD.45546890
Cylance	Unsafe
Sangfor	Malware
Alibaba	Trojan:Win32/Chapak.93b59ef3
K7GW	Trojan ( 00575d741 )
Cybereason	malicious.f48908
BitDefenderTheta	Gen:NN.ZexaF.34780.@pGfay2iXJdc
Cyren	W32/Trojan.ZJOU-0729
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	Trojan.Win32.Chapak.eyla
BitDefender	Trojan.GenericKD.45546890
Paloalto	generic.ml
AegisLab	Trojan.Win32.Chapak.4!c
Rising	Trojan.Kryptik!1.D183 (CLASSIC)
Ad-Aware	Trojan.GenericKD.45546890
Emsisoft	Trojan.GenericKD.45546890 (B)
F-Secure	Trojan.TR/AD.GoCloudnet.maywq
DrWeb	Trojan.PWS.RedLineNET.4
TrendMicro	TrojanSpy.Win32.ARTEMIS.USMANAJ21
McAfee-GW-Edition	BehavesLike.Win32.RansomGandCrab.rc
Sophos	Mal/Generic-S
Ikarus	Trojan.MalPack
Webroot	W32.Trojan.Gen
Avira	TR/AD.GoCloudnet.maywq
Microsoft	Trojan:Win32/Ranumbot.RD!MTB
Gridinsoft	Trojan.Win32.Packed.oa
Arcabit	Trojan.Generic.D2B6FD8A
ZoneAlarm	Trojan.Win32.Chapak.eyla
GData	Trojan.GenericKD.45546890
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Gen.Reputation.C4304597
Acronis	suspicious
McAfee	GenericRXAA-AA!F46ABC9AD768
VBA32	TrojanSpy.Stealer
Malwarebytes	Trojan.MalPack.GS
ESET-NOD32	WinGo/RanumBot.J
TrendMicro-HouseCall	TrojanSpy.Win32.ARTEMIS.USMANAJ21
Tencent	Win32.Trojan.Chapak.Ecac
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Kryptik.GWXD!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/RnkBend.A
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Generic/Trojan.946

How to remove Trojan:Win32/Ranumbot.RD!MTB?

Trojan:Win32/Ranumbot.RD!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Ranumbot.RD!MTB removal tips