Trojan:Win32/Redline.SHL!MTB (file analysis)

The Trojan:Win32/Redline.SHL!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Redline.SHL!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Checks adapter addresses which can be used to detect virtual network interfaces
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Kannada
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Attempts to modify proxy settings

How to determine Trojan:Win32/Redline.SHL!MTB?

File Info:
name: 2C04184DEEE1C5A8EB68.mlw
path: /opt/CAPEv2/storage/binaries/f2d2c5e2e8475c37a60a7cc6f34aeb956910c44b7767379b0ecb0702d29b85bd
crc32: 8AEA9211
md5: 2c04184deee1c5a8eb68e64117e9ca28
sha1: ed6eabc336ac69033d349ca9fda208608866ea04
sha256: f2d2c5e2e8475c37a60a7cc6f34aeb956910c44b7767379b0ecb0702d29b85bd
sha512: 2ba6e7f315145a41ce81115ae3d39b34be43d06c6a8475f8c5b95a141d1668d4613339a563df221986e9810ec710a348a436f72eeb1ac3dfe2c4e48979e0f2fb
ssdeep: 6144:5HWMkdWH3qcsx+MQI2P2EzFpsWW687GUW:5X3qpoMZs2EzFpsi875
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16F44F12179E09C31E8F7753095B1C62226BFB8637170818AB7B427299F64BD06E347E7
sha3_384: 4ee7a96ac3b00b2c59e16330cf5fececbe74ed901141efee2036bb7d0740bdf0fcb3ccae448bd9bfd46221c395a57bcf
ep_bytes: e8aa540000e989feffffcccccccccce8
timestamp: 2021-03-09 17:23:22

Version Info:
FileVersions: 48.90.12.34
Copyrighz: Copyright (C) 2022, pozkarte
ProjectVersion: 82.79.7.9

Trojan:Win32/Redline.SHL!MTB also known as:

How to remove Trojan:Win32/Redline.SHL!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.