Trojan:Win32/Reline.RA!MTB removal instruction

The Trojan:Win32/Reline.RA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Reline.RA!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Tries to suspend Cuckoo threads to prevent logging of malicious activity
• Anomalous binary characteristics

How to determine Trojan:Win32/Reline.RA!MTB?

File Info:
name: 2F453310F098F258077F.mlw
path: /opt/CAPEv2/storage/binaries/c85fbe74e732833f2bb0db33c577c2eb06166fab9b7d0f7e45744a811e4aee5a
crc32: F9CBACA4
md5: 2f453310f098f258077f7040f340eb9e
sha1: 0c76bb155f8b0a107f1cb3bb8d7d343ae40386a3
sha256: c85fbe74e732833f2bb0db33c577c2eb06166fab9b7d0f7e45744a811e4aee5a
sha512: f88808e237d35ee2dc7dbbc419d71d5265ecc3f8666ce9118cdf52d69c60391ff9c57c7a16ae753f838a7da3d046ee9ebc0424075e809c1be5fb3ba2185c007d
ssdeep: 98304:pbKU2g1jp4O5zBeE35PC8Tcw8MQAkq7LH+CU21p3a1eM9pgjSgR:p+kDNBpVHHnLHGsp3a1eUM
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11316333E3061191DC015F6B5AD7F7D27CACD4B7C10BE4626726F0E00AA9ECD09A8EB65
sha3_384: 555c3329d582990cf95145150dc0a84fb1f97a5bc55292d0e1233569126cea2ba7e9f2ae6384f0e5a94c96aea0cf1e94
ep_bytes: 6801708700e801000000c3c334e70278
timestamp: 2021-12-16 16:09:30

Version Info:
0: [No Data]

Trojan:Win32/Reline.RA!MTB also known as:

How to remove Trojan:Win32/Reline.RA!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.