Trojan:Win32/Stealerc.NS!MTB malicious file

The Trojan:Win32/Stealerc.NS!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Stealerc.NS!MTB virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Stealerc.NS!MTB?


File Info:
name: 1D1651FC7B0E1B1A3C54.mlw
path: /opt/CAPEv2/storage/binaries/4b17c6e9096e51b71734daaa456cd7c39266bc3f62188467a4aa45116a39c25b
crc32: 86C02CCD
md5: 1d1651fc7b0e1b1a3c54990ceea8555c
sha1: fabed857af3b8a0c24eda1146eb4a2f2c9cdf256
sha256: 4b17c6e9096e51b71734daaa456cd7c39266bc3f62188467a4aa45116a39c25b
sha512: b98ab683d6565ed88ad2db8fd1180746b28ec635f2d7276fd6e465a877347c91d085b7ab2cca3347dc51e1878e00d0a4d602ff62b6c36b9131d2bc53f0a592c1
ssdeep: 12288:TJDm0NIl0xHm/3dm9aNlL5fpdhNbtQT9DX+ecruiTb5GqYPBNCTw2:tDm0NI+Hm/Nm9aNlNBNbKZOLCBm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DB359E3178C58175EDF221B743ECF62682AE94B0C75955DF12D41AEED710AC2AF32B82
sha3_384: d6d4627b38ccbb51ea32c5b356224379331e57a0295a54e118b929bd10fd6e225a1ef09723b1571ca02d71efd3f1928a
ep_bytes: e9b02a0400e9eebe0500e92bb10400e9
timestamp: 2023-10-27 10:31:40

Version Info:
0: [No Data]

Trojan:Win32/Stealerc.NS!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ser.Zusy.4697
FireEye	Gen:Variant.Ser.Zusy.4697
Skyhigh	BehavesLike.Win32.Generic.th
ALYac	Gen:Variant.Mikey.157757
Malwarebytes	Trojan.MalPack.RND
VIPRE	Gen:Variant.Mikey.157757
K7AntiVirus	Trojan ( 005aa09f1 )
BitDefender	Gen:Variant.Ser.Zusy.4697
K7GW	Trojan ( 005aa09f1 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ETFD
APEX	Malicious
ClamAV	Win.Packed.Pwsx-10012424-0
Kaspersky	HEUR:Backdoor.Win32.Mokes.gen
Alibaba	Backdoor:Win32/Stealerc.dd8036b7
NANO-Antivirus	Trojan.Win32.Mokes.kctxxw
Rising	Backdoor.Convagent!8.123DC (TFE:5:mRU6n37KkvD)
Emsisoft	Gen:Variant.Ser.Zusy.4697 (B)
F-Secure	Trojan.TR/AD.Nekark.rtzpm
DrWeb	Trojan.Inject4.63442
Sophos	Troj/Krypt-ABY
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE.12PQFKD
Varist	W32/Kryptik.KNN.gen!Eldorado
Avira	TR/AD.Nekark.rtzpm
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Win32.GenKryptik
Arcabit	Trojan.Ser.Zusy.D1259
ZoneAlarm	HEUR:Backdoor.Win32.Mokes.gen
Microsoft	Trojan:Win32/Stealerc.NS!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Evo-gen.C5364807
BitDefenderTheta	Gen:NN.ZexaF.36792.ezW@ay3Nhhk
DeepInstinct	MALICIOUS
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0DJR23
Tencent	Win32.Backdoor.Mokes.Kqil
Ikarus	Trojan.Win32.Redline
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Kryptik.HUYH!tr
AVG	Win32:PWSX-gen [Trj]
Avast	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:Win32/Stealerc.NS!MTB?

Trojan:Win32/Stealerc.NS!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X