Trojan:Win32/Redline.SPWE!MTB removal guide

The Trojan:Win32/Redline.SPWE!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Redline.SPWE!MTB virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Redline.SPWE!MTB?


File Info:
name: 71E125251A0603C2E767.mlw
path: /opt/CAPEv2/storage/binaries/0bd589d182e92c10d5681f979f10f5f79358555df758545dd5d4165e778742be
crc32: DC4495F1
md5: 71e125251a0603c2e76714ca4791d779
sha1: e8201d9b061043cee7589263037bf9be55682649
sha256: 0bd589d182e92c10d5681f979f10f5f79358555df758545dd5d4165e778742be
sha512: 887b448e90d73c70c7c26701fcf7ac32e679d48b4ca5a4db9ef4134fe6e7efb2eb6f18399bfafb3b0c034e3a3158bd06168e00e4d0ab84446a618ba66cb94e80
ssdeep: 12288:jURbykbPUI5zaQhnS8oFfTOuPgU1rGVC8EMgV:jUokwt5EC81gV
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T105D4AE50F48F9932C88708734FFAA6B26D676451071293FF5B547BB8AE601E04D7FA22
sha3_384: 3e3cda561b409ad4bb6d6db8d9771373ec4554c2e0c61e18fb9d3b0219b0f9540cfa7a55a51e9d795b020e5a32e855fb
ep_bytes: e8a7040000e974feffff558bec81ec24
timestamp: 2024-01-03 04:47:51

Version Info:
0: [No Data]

Trojan:Win32/Redline.SPWE!MTB also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Lazy.455445
Skyhigh	BehavesLike.Win32.Generic.hh
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
Arcabit	Trojan.Lazy.D6F315
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HVVB
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Packed.Pwsx-10018184-0
Kaspersky	VHO:Trojan.Win32.Sdum.gen
BitDefender	Gen:Variant.Lazy.455445
Avast	Win32:PWSX-gen [Trj]
Emsisoft	Gen:Variant.Lazy.455445 (B)
VIPRE	Gen:Variant.Lazy.455445
Sophos	Generic ML PUA (PUA)
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	Trojan:Win32/Redline.SPWE!MTB
ZoneAlarm	VHO:Trojan.Win32.Sdum.gen
GData	Gen:Variant.Lazy.455445
Google	Detected
AhnLab-V3	Trojan/Win.PWSX-gen.R630165
MAX	malware (ai score=83)
Malwarebytes	Trojan.Crypt.Generic
Rising	Trojan.Kryptik!8.8 (TFE:5:FwiO523p0UC)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Kryptik.HVVB!tr
BitDefenderTheta	Gen:NN.ZexaF.36680.LuW@aKxu4jc
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Redline.SPWE!MTB?

Trojan:Win32/Redline.SPWE!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X