Trojan:Win32/TrickBot.CZ!MTB malicious file

The Trojan:Win32/TrickBot.CZ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/TrickBot.CZ!MTB virus can do?

Executable code extraction
Creates RWX memory
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Installs itself for autorun at Windows startup
Creates a copy of itself

How to determine Trojan:Win32/TrickBot.CZ!MTB?


File Info:
crc32: FF3F86E1
md5: 562d67030434843b467fc5f5823868bb
name: 562D67030434843B467FC5F5823868BB.mlw
sha1: c31be8eba343f168579504c2cfae532ebf866bea
sha256: 559e99ffcc9faaba1dc85a3156a9ddb554698b124026a83952fc04153605b24d
sha512: 0873f75b860cf1d6471931c60d7ad0cd6fff7b8d2d17eb0a326dbbde757ab81149beef4e9b130aefc2fe90b1492d063f374e9813cb0f5e5bd90d8a01af9aaba7
ssdeep: 12288:MSP99CVRmAkiid/ji/WTGzDDHE7QkWtIfZhZVhpRL/NK1kTCqmzaekxnh:3KwAYpm/iGzDBQHXK1kTNmDkhh
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2005
InternalName: AdvancedTaskManager
FileVersion: 1, 0, 0, 1
CompanyName: 
PrivateBuild: 
LegalTrademarks: 
Comments: Madhu Raykar
ProductName: AdvancedTaskManager Application
SpecialBuild: 
ProductVersion: 1, 0, 0, 1
FileDescription: AdvancedTaskManager MFC Application
OriginalFilename: AdvancedTaskManager.EXE
Translation: 0x0409 0x04b0

Trojan:Win32/TrickBot.CZ!MTB also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.Inject3.31961
MicroWorld-eScan	DeepScan:Generic.TrickBot.1.6BBC27CC
FireEye	Generic.mg.562d67030434843b
McAfee	GenericRXAA-AA!562D67030434
Sangfor	Malware
K7AntiVirus	Trojan ( 00521b151 )
BitDefender	DeepScan:Generic.TrickBot.1.6BBC27CC
K7GW	Trojan ( 00521b151 )
TrendMicro	TrojanSpy.Win32.TRICKBOT.SMC
BitDefenderTheta	Gen:NN.ZexaCO.34634.Ny1@aegH9Ici
Cyren	W32/Agent.BKY.gen!Eldorado
Symantec	Trojan.Emotet
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
ClamAV	Win.Dropper.TrickBot-7473393-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.gen
Rising	HackTool.CeeInject!8.B22 (TFE:3:lnKB9NnxARL)
Ad-Aware	DeepScan:Generic.TrickBot.1.6BBC27CC
Invincea	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Injector.jh
Emsisoft	DeepScan:Generic.TrickBot.1.6BBC27CC (B)
Ikarus	Trojan.Win32.Krypt
Microsoft	Trojan:Win32/TrickBot.CZ!MTB
Gridinsoft	Trojan.Win32.Emotet.dd!n
Arcabit	DeepScan:Generic.TrickBot.1.6BBC27CC
SUPERAntiSpyware	Trojan.Agent/Gen-TrickBot
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.gen
GData	DeepScan:Generic.TrickBot.1.6BBC27CC
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Trickbot.R304684
MAX	malware (ai score=89)
Malwarebytes	Trojan.TrickBot
ESET-NOD32	a variant of Win32/Kryptik.GZWV
TrendMicro-HouseCall	TrojanSpy.Win32.TRICKBOT.SMC
Tencent	Malware.Win32.Gencirc.10b7d851
Yandex	Trojan.GenAsa!utLxiIwg6eQ
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_56%
Webroot	W32.Trojan.Trickbot
AVG	Win32:BankerX-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (D)
Qihoo-360	HEUR/QVM20.1.4BAF.Malware.Gen

How to remove Trojan:Win32/TrickBot.CZ!MTB?

Trojan:Win32/TrickBot.CZ!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X