Trojan

Trojan:Win32/Tnega.PKD!MTB removal guide

Malware Removal

The Trojan:Win32/Tnega.PKD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan:Win32/Tnega.PKD!MTB virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (2 unique times)
  • Creates RWX memory
  • Starts servers listening on 127.0.0.1:0
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Performs some HTTP requests
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Detects Sandboxie through the presence of a library
  • Detects Avast Antivirus through the presence of a library
  • Checks for the presence of known windows from debuggers and forensic tools
  • Network activity contains more than one unique useragent.
  • Writes a potential ransom message to disk
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
t.gogamec.com
www.listincode.com
hsiens.xyz
ocsp.digicert.com
mas.to
apps.identrust.com
statuse.digitalcertvalidation.com
iplogger.org
ggg-cl.biz

How to determine Trojan:Win32/Tnega.PKD!MTB?


File Info:

crc32: 597A8039
md5: d878f110c44bb759b5a3077184b4e13f
name: D878F110C44BB759B5A3077184B4E13F.mlw
sha1: d28759148247a32b2028cfc07216ff2be5d7591e
sha256: 8ad93c78ccfbcb0cb2b472d3306e918617829c39085c5306fa8ab05dd55c9a55
sha512: ef7cb4992a0f8307e7b5d953d7997dbe797775350985834465be8a2183df1e7eeefbb0c4b297adbe083dbd341d7cb861e8ce20f40bb2a4a6c52e5e6f23a70631
ssdeep: 98304:x5CvLUBsgERncPxk921V23cXRsn+2ul9Uvx3KqQ5YGRH:xyLUCgK9HcXa+Vl9VJ5YSH
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (c) 1999-2018 Igor Pavlov
InternalName: 7zS.sfx
FileVersion: 19.00
CompanyName: Igor Pavlov
ProductName: 7-Zip
ProductVersion: 19.00
FileDescription: 7z Setup SFX
OriginalFilename: 7zS.sfx.exe
Translation: 0x0409 0x04b0

Trojan:Win32/Tnega.PKD!MTB also known as:

K7AntiVirusTrojan ( 00588bc31 )
LionicTrojan.Win32.Stealer.l!c
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Steam.20866
MicroWorld-eScanGen:Variant.Jaik.45703
CAT-QuickHealTrojan.GenericRI.S23907132
ALYacGen:Variant.Jaik.45703
CylanceUnsafe
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaBackdoor:Win32/Cryprar.ab4f7c46
K7GWTrojan ( 00588bc31 )
Cybereasonmalicious.0c44bb
CyrenW32/Kryptik.FMD.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32multiple detections
AvastWin32:DropperX-gen [Drp]
CynetMalicious (score: 100)
KasperskyTrojan-PSW.Win32.Disbuk.adn
BitDefenderGen:Variant.Jaik.45703
ViRobotTrojan.Win32.Z.Jaik.4446132
TencentWin32.Backdoor.Agent.Wsaa
Ad-AwareGen:Variant.Jaik.45703
SophosMal/Generic-R
ComodoMalware@#p9h9c5lcru23
BitDefenderThetaGen:NN.ZedlaF.34266.n88baOE@FOp
TrendMicroTROJ_GEN.R002C0DJ921
McAfee-GW-EditionGenericRXQJ-OJ!118CF2A718EB
FireEyeGen:Variant.Jaik.45703
EmsisoftGen:Variant.Jaik.45703 (B)
JiangminTrojan.Zapchast.se
WebrootW32.Trojan.Gen
AviraTR/YAV.Minerva.fyzpz
Antiy-AVLTrojan/Generic.ASMalwS.34B08BF
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftTrojan:Win32/Tnega.PKD!MTB
GDataWin32.Trojan-Spy.BeamLoader.3AR5DY
AhnLab-V3Malware/Win.Generic.C4689972
McAfeeArtemis!D878F110C44B
MAXmalware (ai score=84)
VBA32BScope.Trojan.Tasker
MalwarebytesTrojan.Dropper.SFX.Generic
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_GEN.R002C0DJ921
RisingTrojan.Starter!1.D93D (CLASSIC)
MaxSecureTrojan.Malware.771626.susgen
FortinetW32/BSE.4Q7Q!tr
AVGWin32:DropperX-gen [Drp]
Paloaltogeneric.ml

How to remove Trojan:Win32/Tnega.PKD!MTB?

Trojan:Win32/Tnega.PKD!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment