Trojan:Win32/Tnega.OBT!MTB removal

The Trojan:Win32/Tnega.OBT!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Tnega.OBT!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Serbian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the Vidar malware family
• Attempts to modify proxy settings
• Harvests cookies for information gathering

How to determine Trojan:Win32/Tnega.OBT!MTB?

File Info:
name: 8BA0348557DF315ED496.mlw
path: /opt/CAPEv2/storage/binaries/c2622770b53d657adbfce628040dcd39c0c6b1323fe4c3bd19962fa1bf500cb0
crc32: CD3A5BEF
md5: 8ba0348557df315ed496de953472ea74
sha1: 4f31cade92e483ac06d6b2f6eec6acf0c824288f
sha256: c2622770b53d657adbfce628040dcd39c0c6b1323fe4c3bd19962fa1bf500cb0
sha512: 459c38d77efc4f7bf14f8249df4b66a771e353ff623f43835cbc5750a4b45375fd21f43068e1b19084dfc59cb5b1f99ebc455dd510e3c0ad09eb5293a272be73
ssdeep: 12288:Ruxo2pBkADlcPcwXohpJhJTvIMEfITRxEvb+rUnBOe1sWrt/3CSesG36zucm73:MCADlacfDhTvIrf4RxEW6BOWsWrt/SSE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12AF4F140BBA0D039E0B715F8B5B5D37C643A7CA15B2491CBA2D66ADF06386E4ECB1347
sha3_384: 243edc8e6f57cea7bbb8f8412612bbd02fdcba32aaa662d85001649cd2f7f06b674521653e2fba5d75fb126e8b6e625e
ep_bytes: 8bff558bece876900000e8110000005d
timestamp: 2021-08-20 14:53:39

Version Info:
Translations: 0x0025 0x0243

Trojan:Win32/Tnega.OBT!MTB also known as:

How to remove Trojan:Win32/Tnega.OBT!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.