Should I remove “Win32:Bladabindi-AL [Trj]”?

The Win32:Bladabindi-AL [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:Bladabindi-AL [Trj] virus can do?

The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine Win32:Bladabindi-AL [Trj]?


File Info:
name: ADCE19FDA4E23844F185.mlw
path: /opt/CAPEv2/storage/binaries/b31d5307f3e8ccc4769fc106849e2ac298e23972953fe948d87fd456f550da5e
crc32: 4E2060AF
md5: adce19fda4e23844f185427d6b2f0c63
sha1: 250e86839dac36b21535f700e74594ead5115e7a
sha256: b31d5307f3e8ccc4769fc106849e2ac298e23972953fe948d87fd456f550da5e
sha512: 09a7ae4e9921e17ec896a4549b1c3fffdc405eb9da081f7835ee17ec2373ff649e9c0a5300e246ca155d59fc12a539fb71b1ba6a669afdb16302f182577460b4
ssdeep: 192:W9JWlzDCRqBDlUoURjUvv7n71PfU3858xvHls1lBcM165Ok:AUKASQvv7n71T0ZMm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C042B673985198B6F62B543106F21B7CF53882A14BE4AD47DFE8CCB09D22375EB4A50C
sha3_384: a1ac9a1da5daeb8771baaf7f9f57dde2799adb87273a00d6e719911078577f03bb219e95b4736f22b13cf99367b9ba23
ep_bytes: e88b120000e8b311000033c0c3909090
timestamp: 2015-01-27 03:56:27

Version Info:
0: [No Data]

Win32:Bladabindi-AL [Trj] also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.72354
FireEye	Generic.mg.adce19fda4e23844
ALYac	Trojan.GenericKDZ.72354
K7AntiVirus	Trojan ( 0052c0541 )
K7GW	Trojan ( 0052c0541 )
Cybereason	malicious.da4e23
Cyren	W32/Agent.ARA.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Kryptik.HFLZ
APEX	Malicious
Kaspersky	Trojan-Dropper.Win32.Dinwod.acqn
BitDefender	Trojan.GenericKDZ.72354
NANO-Antivirus	Trojan.Win32.Dinwod.dnwsrg
Avast	Win32:Bladabindi-AL [Trj]
Emsisoft	Trojan.GenericKDZ.72354 (B)
DrWeb	Trojan.Inject1.58305
VIPRE	Trojan.Win32.Agent.xfc (v)
McAfee-GW-Edition	BehavesLike.Win32.Generic.lt
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanDropper.Dinwod.pc
Antiy-AVL	Trojan/Generic.ASBOL.C4EC
Microsoft	Trojan:Win32/Woreflint.A!cl
GData	Win32.Trojan.PSE.RKU79T
Cynet	Malicious (score: 100)
McAfee	GenericRXGL-AL!ADCE19FDA4E2
MAX	malware (ai score=86)
Malwarebytes	Trojan.Agent
Rising	Malware.Heuristic!ET#96% (RDMK:cmRtazoWXZMRNMGKP3EjcM0Hd0Bd)
Ikarus	Trojan.Win32.Agent
MaxSecure	CORRUPT:Trojan.Gofot.ges
Fortinet	W32/Agent.RGU!tr
AVG	Win32:Bladabindi-AL [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Win32:Bladabindi-AL [Trj]?

Win32:Bladabindi-AL [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X