Trojan:Win32/VBcrypt.WSG!MTB information

The Trojan:Win32/VBcrypt.WSG!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/VBcrypt.WSG!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Maori
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Deletes executed files from disk
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/VBcrypt.WSG!MTB?

File Info:
name: 1826D4154E7360C69057.mlw
path: /opt/CAPEv2/storage/binaries/d40f90bb483a3c75354e434ad6568fcf20f5dd647c8823dee0fdaf31c5035a08
crc32: 4A7E1C15
md5: 1826d4154e7360c69057bfd75e71462f
sha1: 89947a09c9bff2fab95838dbe3db54d8aa9eff9b
sha256: d40f90bb483a3c75354e434ad6568fcf20f5dd647c8823dee0fdaf31c5035a08
sha512: ea4c3527db07a95d5365666c18a0318fc12b07651c70fa5baece08b9114d38650e7b3cee329e524118c5dff203be8a46eef4f74ec9efed7f6a26dee332286aae
ssdeep: 12288:t6aox+uVpHdmMcm8AlCJskKZGR/Sgno+kzhmAkh:tHk9VNdQAUKi/y1j
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10694E1352DF9F1B3CA3A817BDDA106B9F16599282307AC0B90C7174A1E13A573DF960E
sha3_384: 81c10df5b0594fdb90690594887de2ad31d53dc011aef7261b4df26fe37b01a54b32c2b52aecd858e53be5275117da6e
ep_bytes: 680c154000e8eeffffff000000000000
timestamp: 2012-09-23 23:32:13

Version Info:
Translation: 0x0409 0x04b0
CompanyName: ranc/onne`rent fulminerez
FileDescription: gouttons debarquements conspirions
LegalCopyright: de'duira e'nume'r 2004
LegalTrademarks: chandele surpaye'
ProductName: vassez fiévreuse
FileVersion: 9.05.0008
ProductVersion: 9.05.0008
InternalName: tribue génocide
OriginalFilename: tribue génocide.exe

Trojan:Win32/VBcrypt.WSG!MTB also known as:

How to remove Trojan:Win32/VBcrypt.WSG!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.