Trojan:Win32/Stealerc.NS!MTB removal guide

The Trojan:Win32/Stealerc.NS!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Stealerc.NS!MTB virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Stealerc.NS!MTB?


File Info:
name: 645F6469F8A16381494D.mlw
path: /opt/CAPEv2/storage/binaries/43c8b8931f7105ef6b5b50a102a968fb838df0cb6ec153c4885be2cb3c0e60cb
crc32: 8DBA5356
md5: 645f6469f8a16381494d1c3474fce2b7
sha1: edb6c28116d62dfc654d000bea8d4be630586d7c
sha256: 43c8b8931f7105ef6b5b50a102a968fb838df0cb6ec153c4885be2cb3c0e60cb
sha512: c1b31b7eff84ea08656f4ac8871886e526a34b562fb445fea014b6fca9aba53044828e8ed48d94463441eba354389e213d13ca5490035f8fb17887e6d77734c3
ssdeep: 24576:loVsQmNw1bov27aDVS3RW8jn5uX1ERtDNpE:OKGbov27ao3RJuXIxE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15B358D21F8C14172EEE210B742ECFE69426DA4B0071959DF22DD3BFED6506C26F3259A
sha3_384: 580287ea8224ef321b0ed9c7f53615379d4bf728e19701698779a0afe41a33ff8e44407f9656f1c002275d651d7e759d
ep_bytes: e918f90300e970ee0600e9927f0400e9
timestamp: 2023-11-02 12:34:18

Version Info:
0: [No Data]

Trojan:Win32/Stealerc.NS!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stealer.12!c
DrWeb	Trojan.KillProc2.22173
MicroWorld-eScan	Trojan.Inject.BFC
FireEye	Trojan.Inject.BFC
Skyhigh	BehavesLike.Win32.Sabsik.th
ALYac	Trojan.Inject.BFC
VIPRE	Trojan.Inject.BFC
K7AntiVirus	Trojan ( 005aa1da1 )
BitDefender	Trojan.Inject.BFC
K7GW	Trojan ( 005aa1da1 )
VirIT	Trojan.Win32.GenusT.DTMS
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.GMZA
APEX	Malicious
ClamAV	Win.Packed.Pwsx-10012424-0
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
NANO-Antivirus	Trojan.Win32.Convagent.kdarii
Rising	Backdoor.Agent!8.C5D (TFE:1:SQVxLVF5OHK)
Sophos	Troj/Krypt-ABY
F-Secure	Trojan.TR/AD.Nekark.hpetm
TrendMicro	TROJ_GEN.R002C0DK523
Emsisoft	Trojan.Inject.BFC (B)
Ikarus	Trojan.Win32.Redline
MAX	malware (ai score=86)
Google	Detected
Avira	TR/AD.Nekark.hpetm
Varist	W32/Kryptik.KNN.gen!Eldorado
Antiy-AVL	Trojan/Win32.GenKryptik
Microsoft	Trojan:Win32/Stealerc.NS!MTB
Arcabit	Trojan.Inject.BFC
ViRobot	Trojan.Win.Z.Inject.1149952.D
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
GData	Win32.Trojan.PSE.1FGYFE3
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.RedLine.R620138
McAfee	GenericRXAA-AA!645F6469F8A1
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.MalPack.RND.Generic
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DK523
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.HUYH!tr
AVG	Win32:PWSX-gen [Trj]
Avast	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:Win32/Stealerc.NS!MTB?

Trojan:Win32/Stealerc.NS!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X