What is “Trojan:Win32/RisePro.GPB!MTB”?

The Trojan:Win32/RisePro.GPB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/RisePro.GPB!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Anomalous binary characteristics

How to determine Trojan:Win32/RisePro.GPB!MTB?


File Info:
name: 8BBA8B856E15AE7E4632.mlw
path: /opt/CAPEv2/storage/binaries/8a6f4c3c44b85b1041aae17d252d2620750b89993950de8b9a5d8fbadf7223d7
crc32: 187BAE44
md5: 8bba8b856e15ae7e463270bb6100a440
sha1: 0bd7446e1e4abaa9fb808cb316c08d251382f020
sha256: 8a6f4c3c44b85b1041aae17d252d2620750b89993950de8b9a5d8fbadf7223d7
sha512: a6baacaeb69bef29cda7db42e2d62b4993c2752cb5b4f8075db4f7cd7f58165325e9639ebcb56c42338575af413720442679ea5ca89d860b5f1eafd12a459b44
ssdeep: 98304:Pbl2VQYeMwXsO3AHPh3XC75xqHqU7l3Phs10MH1CVpv:Pbj6vpgX70hs1D8p
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14E569E92B905F1DFC08B13B4B56BCE82695D42F65B2088C7E998787D6F72CC132A5D38
sha3_384: 8f76d9d3f28f96a188b70a3a9c94cbd2c40bf167384fdcbde88200d52fd6449d0723638ee8451d16d8f71e01c28140ff
ep_bytes: 00002d8000000009f681f28000000089
timestamp: 2024-01-24 07:18:15

Version Info:
0: [No Data]

Trojan:Win32/RisePro.GPB!MTB also known as:

Bkav	W32.AIDetectMalware
Elastic	Windows.Generic.Threat
FireEye	Generic.mg.8bba8b856e15ae7e
Skyhigh	BehavesLike.Win32.Generic.th
McAfee	Artemis!8BBA8B856E15
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaCO.36802.@BZ@aGEa7Zo
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
TrendMicro-HouseCall	TROJ_GEN.R03BH01DC24
ClamAV	Win.Malware.Mikey-10019377-0
Avast	Win32:TrojanX-gen [Trj]
Trapmine	malicious.high.ml.score
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
Google	Detected
Antiy-AVL	Trojan/Win32.Sabsik
Microsoft	Trojan:Win32/RisePro.GPB!MTB
Cynet	Malicious (score: 100)
Malwarebytes	Malware.AI.3282135155
Zoner	Probably Heur.ExeHeaderL
Rising	Downloader.Agent!1.D93C (CLASSIC)
Ikarus	Trojan.Crypt
Fortinet	W32/PossibleThreat
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/RisePro.GPB!MTB?

Trojan:Win32/RisePro.GPB!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X