Trojan:Win32/Redline.RTR!MTB removal guide

The Trojan:Win32/Redline.RTR!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Redline.RTR!MTB virus can do?

Sample contains Overlay data
Unconventionial language used in binary resources: Rhaeto (Romance)
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Redline.RTR!MTB?


File Info:
name: CC2972DC8BE39EE41E65.mlw
path: /opt/CAPEv2/storage/binaries/5467a8833be4a48db24459ae7971e5df48b3202ab83b650e7463e5bf9d774dcf
crc32: 5F1BAAF1
md5: cc2972dc8be39ee41e65f812074e56db
sha1: 5c5d6239ff9d7a6e53ee88796d683e670cc428f5
sha256: 5467a8833be4a48db24459ae7971e5df48b3202ab83b650e7463e5bf9d774dcf
sha512: 81e2b6d05bcc5b165c958a7bfbf8fe71da93411f815d16649c3c162c36d66bfdd17e6b2d82bfab1401e39f3f931413af5aa430e7b6022b8a7356795cc21a9e52
ssdeep: 3072:MCkLX2ylbq54o15We10BFtTpkeAspspspspspspspspspspspspspspspspspspD:0LX2yl5oyFt6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T125B67118FAEC945AE1A62D3A593586955B3BFCDBF96403C6318C3F0FAC326901A51F13
sha3_384: 0b8319e3be6517bfb5d2ea2be46dc958c8264264c2ef4eed655cabacfbff584990a342a25fa6fe1a5f0745a861d1f00e
ep_bytes: e8bc3a0000e979feffff558bec83ec04
timestamp: 2021-06-21 18:01:32

Version Info:
Translations: 0x0542 0x007d

Trojan:Win32/Redline.RTR!MTB also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
FireEye	Generic.mg.cc2972dc8be39ee4
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0059a0021 )
K7GW	Trojan ( 0059a0021 )
Cybereason	malicious.9ff9d7
Cyren	W32/Convagent.BC.gen!Eldorado
Symantec	Packed.Generic.528
ESET-NOD32	a variant of Win32/Kryptik.HRNT
APEX	Malicious
Sophos	ML/PE-A + Troj/Krypt-QV
DrWeb	Trojan.Siggen19.7052
TrendMicro	Mal_Tofsee
McAfee-GW-Edition	BehavesLike.Win32.Lockbit.vt
Trapmine	malicious.high.ml.score
SentinelOne	Static AI – Malicious PE
Google	Detected
Antiy-AVL	Trojan/Win32.Sabsik
Microsoft	Trojan:Win32/Redline.RTR!MTB
Cynet	Malicious (score: 100)
Acronis	suspicious
VBA32	Malware-Cryptor.2LA.gen
TrendMicro-HouseCall	Mal_Tofsee
Rising	Trojan.Generic@AI.100 (RDML:p7uvbaCa4aCfBN2MTiej2A)
Fortinet	W32/Kryptik.HRNP!tr
Panda	Trj/Genetic.gen

How to remove Trojan:Win32/Redline.RTR!MTB?

Trojan:Win32/Redline.RTR!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X