How to remove “Trojan:Win32/Redline.GFV!MTB”?

The Trojan:Win32/Redline.GFV!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Redline.GFV!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Spanish (Mexican)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities to create a scheduled task
• CAPE detected the RedLine malware family
• Attempts to identify installed AV products by installation directory
• Attempts to modify proxy settings
• Appears to use command line obfuscation
• Deletes executed files from disk
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Redline.GFV!MTB?

File Info:
name: 42D8D60FCC396927B91B.mlw
path: /opt/CAPEv2/storage/binaries/790dca1792f05311c08c283279d3a9f424f44db35d8eb2c13defc5123260b8b9
crc32: 5A16E888
md5: 42d8d60fcc396927b91bec01f2df475a
sha1: b11434e583b06e2a4a1e2f3970597dc87f6d5166
sha256: 790dca1792f05311c08c283279d3a9f424f44db35d8eb2c13defc5123260b8b9
sha512: 36a76f2b1a6ac050e399f6f31e64d0feca1545f4a5977f138d15a7cd6bd69e0f243caffa962c88950f8e20458c5cca7a91b024182643b15f72e8885f4616b60e
ssdeep: 24576:it0mgo7IYRQq6madDc0MFjRGSucplKTg4s5mCN0TU8/ByKJh0otC:i1T7I5fAXjRGStlKFss1Tj/Byqh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14F451303A691B8E2FB6741354F1ED598BA6FB5318E4C9643331C6A3F19B02F2C2A7315
sha3_384: 18675db168c5d79778c481fb2b873cdab2da61ef346d5ab0fbf48ba25231dcb00d0b2e295ffe421cfcf2a42225b1a182
ep_bytes: e8893d0000e979feffffcccccccccccc
timestamp: 2021-12-26 09:47:32

Version Info:
FilesVersion: 15.15.66.51
InternalNamy: GoalHard
LegalasCopyright: Copyright (C) 2023, shmaer
ProductNames: SmothPath
Translation: 0x04fe 0x03ff

Trojan:Win32/Redline.GFV!MTB also known as:

How to remove Trojan:Win32/Redline.GFV!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.