Trojan:Win32/RedLine.RDDK!MTB removal tips

The Trojan:Win32/RedLine.RDDK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/RedLine.RDDK!MTB virus can do?

Authenticode signature is invalid

How to determine Trojan:Win32/RedLine.RDDK!MTB?


File Info:
name: 306F621F7AC9B001F89A.mlw
path: /opt/CAPEv2/storage/binaries/a8595e0c2a3c6174b859780b4277cd743a5505f56f3f0979e6aa87793f7f82ac
crc32: C5523CFD
md5: 306f621f7ac9b001f89aa66179b42c00
sha1: ee495b17ed611b6f9cf62ce41d8c6cca26034d5f
sha256: a8595e0c2a3c6174b859780b4277cd743a5505f56f3f0979e6aa87793f7f82ac
sha512: 076597e13295eff9167360b7ad2ef8e6c4e011fe2725c9446d1815997bcd8180551ac7fd712e2b1b8085bb4749d2bc5df4a07044f354d186fdf27a1dea8b13a5
ssdeep: 6144:zQC3ljS9PgGzqLHvw1t6mAO4gOWSsFSfDSQXJzNZQcjo3viKC:zQAS9PgGimmgO9tzNuiiiKC
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T11374BF00B9C08476D46DDE300BF0DB750E3D74A09B2966AB7BF62F785F247C1922956B
sha3_384: a1f898a56ea8d9e94a61b272c31eb65ae0ef18bf5aad7e3a4eaf4d7b67eedebc3227982762604463ea69f7568eaf05c6
ep_bytes: e8f2070000e974feffff558bec8b4508
timestamp: 2023-09-27 16:23:49

Version Info:
0: [No Data]

Trojan:Win32/RedLine.RDDK!MTB also known as:

Bkav	W32.Common.E96A683E
Lionic	Trojan.Win32.RedLine.i!c
MicroWorld-eScan	Gen:Variant.Zusy.494463
FireEye	Generic.mg.306f621f7ac9b001
CAT-QuickHeal	Trojan.GenericPMF.S31412796
Skyhigh	BehavesLike.Win32.Generic.fh
McAfee	GenericRXAA-AA!306F621F7AC9
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005abe431 )
Alibaba	TrojanPSW:Win32/RedLine.d40db7fc
K7GW	Trojan ( 005abe431 )
Arcabit	Trojan.Zusy.D78B7F
BitDefenderTheta	Gen:NN.ZexaF.36608.vqW@aeeVyBf
VirIT	Trojan.Win32.GenusT.DSEQ
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.GOHF
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.Win32.Stealerc.gen
BitDefender	Gen:Variant.Zusy.494463
NANO-Antivirus	Trojan.Win32.Inject4.kbjgqb
Avast	Win32:PWSX-gen [Trj]
Tencent	Malware.Win32.Gencirc.10bf2d53
TACHYON	Trojan-Spy/W32.InfoStealer.354816.G
Emsisoft	Gen:Variant.Zusy.494463 (B)
F-Secure	Trojan.TR/AD.Nekark.qhgpk
DrWeb	Trojan.Inject4.61437
VIPRE	Gen:Variant.Zusy.494463
TrendMicro	TROJ_GEN.R002C0DJ423
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Varist	W32/Kryptik.KSV.gen!Eldorado
Avira	TR/AD.Nekark.qhgpk
Antiy-AVL	Trojan[Backdoor]/Win32.Mokes.gen
Kingsoft	malware.kb.a.718
Microsoft	Trojan:Win32/RedLine.RDDK!MTB
ZoneAlarm	HEUR:Trojan-PSW.Win32.Stealerc.gen
GData	Gen:Variant.Zusy.494463
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R608180
VBA32	TrojanPSW.RedLine
ALYac	Gen:Variant.Zusy.494463
MAX	malware (ai score=88)
Malwarebytes	Trojan.MalPack.SAB.Generic
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0DJ423
Rising	Trojan.SmokeLoader!1.EB4F (CLASSIC)
Ikarus	Trojan.Win32.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.HUTD!tr
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:Win32/RedLine.RDDK!MTB?

Trojan:Win32/RedLine.RDDK!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X