What is “Trojan:Win32/RedLine.RPX!MTB”?

The Trojan:Win32/RedLine.RPX!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/RedLine.RPX!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/RedLine.RPX!MTB?


File Info:
name: E86D9D80956CBA628FC8.mlw
path: /opt/CAPEv2/storage/binaries/9cc9623cd4f59c2f240a69c68080e09c2ca845bd9dc5f6a775d5d7726dda3b26
crc32: B623F7D3
md5: e86d9d80956cba628fc8ac4f988a1c36
sha1: 6eb566a12e8c7ddce899d8b45d44625ad563f46f
sha256: 9cc9623cd4f59c2f240a69c68080e09c2ca845bd9dc5f6a775d5d7726dda3b26
sha512: d40b973eaeb1f9690c9ad0c1a666c8209b1ccefb3e07b84d966b711314641e45be9bd88bf2f2d46ae6938a7510f26d66639828bbcad58b85f3c712f79cfbf4df
ssdeep: 6144:Yp5w3TtBWzookICyTDlXFOvK7QAOe6+bRa9ss:YpCBWzookIw7+49ss
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T160258F11B5D1C072D873253209E4DBBA5A3DB9300B6199EF67E40F7E8F306C19672AA7
sha3_384: 1461eaf2f734ca47f9e398c886dc8f8b592ccb10d8e484704e7f4f8e44dc2358df89e9461b4f8878e92548c21ba8a0c1
ep_bytes: e8ca070000e974feffff558bec8b4508
timestamp: 2023-05-24 08:58:29

Version Info:
0: [No Data]

Trojan:Win32/RedLine.RPX!MTB also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Zusy.469415
ClamAV	Win.Trojan.Pwsx-10002387-0
FireEye	Generic.mg.e86d9d80956cba62
ALYac	Gen:Variant.Zusy.469415
Malwarebytes	Trojan.Injector
VIPRE	Gen:Variant.Zusy.469415
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005a5b311 )
Alibaba	Trojan:Win32/Injector.933d0ef5
K7GW	Trojan ( 005a5b311 )
Cybereason	malicious.12e8c7
Cyren	W32/Kryptik.IXI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.ESYR
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender	Gen:Variant.Zusy.469415
Avast	Win32:PWSX-gen [Trj]
Emsisoft	Gen:Variant.Zusy.469415 (B)
F-Secure	Trojan.TR/AD.Nekark.kquvb
McAfee-GW-Edition	BehavesLike.Win32.Generic.fz
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Injector
GData	Gen:Variant.Zusy.469415
Jiangmin	TrojanSpy.Stealer.agrz
Avira	TR/AD.Nekark.kquvb
Arcabit	Trojan.Zusy.D729A7
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
Microsoft	Trojan:Win32/RedLine.RPX!MTB
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5369784
Acronis	suspicious
McAfee	Artemis!E86D9D80956C
MAX	malware (ai score=89)
VBA32	Malware-Cryptor.Inject.gen
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0CEO23
Rising	Backdoor.Agent!8.C5D (TFE:5:kXxJGmNMLUE)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.HSKS!tr
BitDefenderTheta	Gen:NN.ZexaF.36196.@uX@aC1F6Qe
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:Win32/RedLine.RPX!MTB?

Trojan:Win32/RedLine.RPX!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X