Trojan:Win32/Trickbot.VI!MSR malicious file

The Trojan:Win32/Trickbot.VI!MSR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Trickbot.VI!MSR virus can do?

Executable code extraction
Creates RWX memory
Unconventionial language used in binary resources: Assamese
Anomalous binary characteristics

How to determine Trojan:Win32/Trickbot.VI!MSR?


File Info:
crc32: 2B2E31A8
md5: d2cced4d245ecb43e6fd54ca296abf05
name: D2CCED4D245ECB43E6FD54CA296ABF05.mlw
sha1: 02f4f98300fba73d60ddf67035c4992b601d648c
sha256: 3782e28d58580ca9144e7e24ed3631653c44efcea800437a0190a82a9dd5877c
sha512: f88e969526c3176d10e7c942925ad227be4d3e89e63142f1748fa271cacb93fd1caae2741810b8cf17b9ad4c975427adda1e0a8d1cbd005e8e35dd67f9ec6b84
ssdeep: 12288:lni3zkIkkvkkkkkkkkXo4n7r44n7rxhN0zkIkkvkkkkkkkkXugpd6jOoTTCSN2SU:lI04Q45hN0KOkNV8
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
InternalName: HotelDirectory
FileVersion: 1.0.0.0
CompanyName: Bermz ISware Software Solutions
Comments: Engr. Lyndon R. Bermoy
ProductName: Hotel Tavern Surigao
ProductVersion: 1.0.0.0
OriginalFilename: HotelDirectory.exe

Trojan:Win32/Trickbot.VI!MSR also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader34.28634
MicroWorld-eScan	Trojan.GenericKDZ.69690
McAfee	Trickbot-FSTA!D2CCED4D245E
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056d4581 )
BitDefender	Trojan.GenericKDZ.69690
K7GW	Trojan ( 0056d4581 )
Cybereason	malicious.300fba
TrendMicro	TrojanSpy.Win32.EMOTET.SMTHF.hp
BitDefenderTheta	Gen:NN.ZevbaF.34590.Lm0@ammcRmmO
Cyren	W32/Kryptik.BUX.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.SMTHF.hp
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.Win32.Bsymem.vho
Rising	Trojan.Injector!8.C4 (TFE:4:t0XrwcfF0uE)
Ad-Aware	Trojan.GenericKDZ.69690
F-Secure	Heuristic.HEUR/AGEN.1138526
McAfee-GW-Edition	Trickbot-FSTA!D2CCED4D245E
FireEye	Generic.mg.d2cced4d245ecb43
Emsisoft	Trojan.Agent (A)
Ikarus	Trojan-Banker.TrickBot
Jiangmin	Trojan.Bsymem.aex
MaxSecure	Trojan.Malware.105913902.susgen
Avira	HEUR/AGEN.1138526
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Injector
Microsoft	Trojan:Win32/Trickbot.VI!MSR
Arcabit	Trojan.Generic.D1103A
ZoneAlarm	HEUR:Trojan.Win32.Bsymem.vho
GData	Trojan.GenericKDZ.69690
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.CryptInject.R349200
VBA32	TScope.Trojan.VB
ALYac	Trojan.GenericKDZ.69690
TACHYON	Trojan/W32.VB-Bsymem.614400
Malwarebytes	Trojan.TrickBot
Panda	Trj/GdSda.A
APEX	Malicious
ESET-NOD32	a variant of Win32/Injector.ENDK
Yandex	Trojan.Injector!gVWYz2YzSfU
SentinelOne	Static AI – Malicious PE
Fortinet	W32/GenKryptik.EVJU!tr
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_70% (D)
Qihoo-360	HEUR/QVM03.0.3967.Malware.Gen

How to remove Trojan:Win32/Trickbot.VI!MSR?

Trojan:Win32/Trickbot.VI!MSR removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X