What is “Trojan:Win32/Redline.PC!MTB”?

The Trojan:Win32/Redline.PC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Redline.PC!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Kannada
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Trojan:Win32/Redline.PC!MTB?

File Info:
name: 83E3493297E23A1157CE.mlw
path: /opt/CAPEv2/storage/binaries/ef20432fe639075c93524425f3413b484a45da45ba851270baa616e79181755a
crc32: 75F24A6F
md5: 83e3493297e23a1157cea5baaa71e22e
sha1: 76fc72ab935abcdbe461c88a478ffccb231796cb
sha256: ef20432fe639075c93524425f3413b484a45da45ba851270baa616e79181755a
sha512: 5cd9ad8cb4d7c1b26cf2128b3c836a40c9ae9edba0ffc47a1719e4b00e34735b8bfb07df4f1ed47aa73adf885350c206efd97942a8c700c0120e5a6f36eb3bba
ssdeep: 6144:R+wYrqL9mdDN3OREKVNuE3IvV2Id4xTslxahIGbBClQAm:R+AL9mdcEauEYv8Tkxa6GbBYx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B564F12173F1C831D9B3563068B886616B7AB9226F7086CF3764133E8F617D15A7836B
sha3_384: 86cfd149f12997915cd7ceed3435cbb7f95f4d4562c6bd3cd9db77e9a0b351a08d01d840634d87b17a44bbd043b3f7e0
ep_bytes: e8c4640000e989feffffcccccccccccc
timestamp: 2021-02-09 16:30:27

Version Info:
FileVersions: 48.90.12.34
Copyrighz: Copyright (C) 2022, pozkarte
ProjectVersion: 82.79.7.9

Trojan:Win32/Redline.PC!MTB also known as:

How to remove Trojan:Win32/Redline.PC!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.