Trojan:Win32/Stealc.RPX!MTB information

The Trojan:Win32/Stealc.RPX!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Stealc.RPX!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Detects Bochs through the presence of a registry key
• Checks the version of Bios, possibly for anti-virtualization
• Checks the CPU name from registry, possibly for anti-virtualization
• Attempted to write directly to a physical drive
• Accessed credential storage registry keys
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Stealc.RPX!MTB?

File Info:
name: 341F5F90BE7B651929E9.mlw
path: /opt/CAPEv2/storage/binaries/840d68da71a1bd7b625beb8a5a255b62c9f8a26d7e2490784db3d7c736ec278f
crc32: D296AD3E
md5: 341f5f90be7b651929e91e35cea9ee3b
sha1: 258c63fbbf44dea8cbacb8fde2be3f51d91a0551
sha256: 840d68da71a1bd7b625beb8a5a255b62c9f8a26d7e2490784db3d7c736ec278f
sha512: b0907b80e70cfb87d0495098bb695ca5525a285d95dcadda908f474fffe73564de7f8735d9afc560def3634deb741c3de187948afdb1d85b8c9367fa19aef441
ssdeep: 98304:HYbDxOiAVQ+EhOHoqF/spsmvYZx9ZbehEcvA7TPWcBlDv:4XxOvVQwHlNm8x9ZBEsTPWI5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E01633643BE41470F9D442B79578DBD98F8671626077AA0E87D4322CEFF2AC187B0762
sha3_384: ac455dc3df54da9a73ef1df957a8108c1c1f661e27b7d5a84b9c6a97b657ec2c6803ec0c90ffd133411c7b4170e890cf
ep_bytes: e83a2b0000e989feffff8bff558bec81
timestamp: 2023-07-27 12:00:44

Version Info:
FileVersion: 10.3.3.59
ProductVersion: 27.86.10.51
InternalName: Slupido
CompanyName: Torchok
Translation: 0x149d 0x0235

Trojan:Win32/Stealc.RPX!MTB also known as:

How to remove Trojan:Win32/Stealc.RPX!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.