Categories: Malware

VirTool:Win32/Vtub.S (file analysis)

The VirTool:Win32/Vtub.S is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/Vtub.S virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Unconventionial language used in binary resources: Arabic (Egypt)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Yara detections observed in process dumps, payloads or dropped files

How to determine VirTool:Win32/Vtub.S?


File Info:
name: F6B549E688DC7AC2EE66.mlwpath: /opt/CAPEv2/storage/binaries/b838ae42ef7b25c958beeda51065213c0a4d65a2f08618d31c74145a3afc5bd2crc32: D44B47BEmd5: f6b549e688dc7ac2ee66069376638d64sha1: 1e883b57096d7c2cb9bf32e42ab39a30f5375e20sha256: b838ae42ef7b25c958beeda51065213c0a4d65a2f08618d31c74145a3afc5bd2sha512: ac7994c6168b1feb61457f722cf697adc852f271131578950fd1ec7eb7ce8e01dbbeae727146282b381a628de59265f83d2b8e24fde72cd496a9db53e11ce91assdeep: 384:/TsGI/q6f7VzjuOWwxkskxiUPflBIrCmm3GCqSdkuOCkgMfVUd9MrJHWrWxur:/kqK7V/u6xkskxdPflBIrl1UzMfewrrKtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T110D28D46B31AC489C4018774CAAFEABC6737BC250C7485977ED07F3EACF2590791AA52sha3_384: f5a69f566afb905535497f89293f9c7534d6fc2e4402445a640dce4bc70c84fdf9e8548cdfaa1907c9dfe9e9a7e4d3c5ep_bytes: 60be007041008dbe00a0feff5783cdfftimestamp: 2008-04-19 17:56:18
Version Info:
Translation: 0x0409 0x04b0CompanyName: Microsoft Co.ProductName: Microsoft CoFileVersion: 1.00ProductVersion: 1.00InternalName: stubOriginalFilename: stub.exe

VirTool:Win32/Vtub.S also known as:

Elastic	malicious (moderate confidence)
DrWeb	Trojan.MulDrop1.55505
MicroWorld-eScan	Gen:Variant.Johnnie.266104
FireEye	Generic.mg.f6b549e688dc7ac2
Skyhigh	BehavesLike.Win32.Fake.mc
McAfee	Artemis!F6B549E688DC
Cylance	unsafe
Zillya	Dropper.VB.Win32.10238
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	TrojanDropper:Win32/AutoRun.59972dcf
K7GW	Trojan ( 004bcce71 )
K7AntiVirus	Trojan ( 004bcce71 )
BitDefenderTheta	AI:Packer.620F0F5D1F
VirIT	Trojan.Win32.Inject.NK
Symantec	W32.SillyFDC
tehtris	Generic.Malware
ESET-NOD32	Win32/AutoRun.VB.AXX
APEX	Malicious
TrendMicro-HouseCall	PAK_Otorun8
Avast	Win32:Crypt-CJV [Trj]
ClamAV	Win.Trojan.VB-5182
Kaspersky	Trojan-Dropper.Win32.VB.dnny
BitDefender	Gen:Variant.Johnnie.266104
NANO-Antivirus	Trojan.Win32.Agent.ecvrni
Tencent	Malware.Win32.Gencirc.10bf42d6
Emsisoft	Gen:Variant.Johnnie.266104 (B)
F-Secure	Malware.BAT/Agent.52
VIPRE	Gen:Variant.Johnnie.266104
TrendMicro	PAK_Otorun8
Sophos	Mal/FakeMS-U
Ikarus	Trojan.Autorun.SU
Jiangmin	Trojan/Buzus.bjrb
Webroot	W32.Trojan.Gen
Google	Detected
Avira	BAT/Agent.52
Varist	W32/VBTrojan.17B!Generic
Antiy-AVL	Trojan[Dropper]/Win32.VB
Kingsoft	malware.kb.b.950
Microsoft	VirTool:Win32/Vtub.S
Xcitium	TrojWare.Win32.TrojanDropper.Bifrost.C@7pnv
Arcabit	Trojan.Johnnie.D40F78
ViRobot	Trojan.Win32.VB.68389
ZoneAlarm	Trojan-Dropper.Win32.VB.dnny
GData	Gen:Variant.Johnnie.266104
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Xema.C71289
VBA32	Malware-Cryptor.VB.gen.1
ALYac	Gen:Variant.Johnnie.266104
Panda	Trj/Genetic.gen
Rising	Worm.Win32.Autorun.ebp (CLOUD)
Yandex	Trojan.DR.VB!rKWVZrhRbRY
MAX	malware (ai score=100)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Autorun.SUD!tr
AVG	Win32:Crypt-CJV [Trj]
DeepInstinct	MALICIOUS
alibabacloud	Trojan[dropper]:Win/VB.AXX