Trojan:Win32/Trickbot.AS malicious file

The Trojan:Win32/Trickbot.AS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Trickbot.AS virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Scheduled file move on reboot detected
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities for basic functionality
• Attempts to stop active services
• Collects and encrypts information about the computer likely to send to C2 server
• Spoofs its process name and/or associated pathname to appear as a legitimate process
• Creates a hidden or system file
• CAPE detected the TrickBot malware family
• Creates a copy of itself
• Attempts to disable Windows Defender
• Attempts to modify Windows Defender using PowerShell
• Uses suspicious command line tools or Windows utilities

How to determine Trojan:Win32/Trickbot.AS?

File Info:
name: 0C4393AC7258D1713AFE.mlw
path: /opt/CAPEv2/storage/binaries/20fdde71e9956c19963144fce2c20ccd22d5c0752963b10aa8e1821028fde5a8
crc32: F6425181
md5: 0c4393ac7258d1713afe08c020de939f
sha1: 8d71142919d8ee1030271696dd8170b8beb8f6a4
sha256: 20fdde71e9956c19963144fce2c20ccd22d5c0752963b10aa8e1821028fde5a8
sha512: f3ec0775503350b61e819388113fa2956633f35519fab109021a24ca31ecc12cdacbf8e8e23e20ffb62386aa441afbb23a54677f17f2a4f26c28042698fe459a
ssdeep: 12288:lBQ6fu5q7hn7Ei6DVTjWJsAGGnG05l/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMZ:Lq5m17VoTkLnG0D/MMMMMMMMMMMMMMM4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T197B4AE61A6C0B4F6CEE94D772E1ADD305F16BCECE11855A432EC3D9F79FA8B21240192
sha3_384: 573dce3a101a84868d6e75f1a6f129f784d67e70692fdd2e1e26353110bfa9be99f871ec4481d52b44ffb5b36443b613
ep_bytes: 5589e583ec18c7042402000000ff153c
timestamp: 2018-09-17 12:10:01

Version Info:
CompanyName: 
FileVersion: StateRepository Core
FileDescription: StateRepository Core
InternalName: StateRepository Core
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: StateRepository Core
ProductName: StateRepository Core
ProductVersion: StateRepository Core
Translation: 0x0845 0x04e4

Trojan:Win32/Trickbot.AS also known as:

How to remove Trojan:Win32/Trickbot.AS?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.