Categories: Malware

What is “PWS:Win32/PrimaryPass.AD!MTB”?

The PWS:Win32/PrimaryPass.AD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/PrimaryPass.AD!MTB virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Steals private information from local Internet browsers
Spoofs its process name and/or associated pathname to appear as a legitimate process
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Collects information to fingerprint the system

Related domains:

z.whorecord.xyz

a.tomx.xyz

magicview.ga

How to determine PWS:Win32/PrimaryPass.AD!MTB?


File Info:
crc32: 3BF5991Fmd5: cc08084a09b75ba5036ae23bffe9771cname: CC08084A09B75BA5036AE23BFFE9771C.mlwsha1: 470e94e14c86839c65fa5a9663e3903a01402b40sha256: c56da54485cc45f6d2dee79439ec4eacfffba0cbcd494cf6b1eca9277142a1casha512: eaaa9abe0a92d5e6c7e0982c1333b4bd5879cf8759774900247d9d520a6ce0e9e95aa62f1edddfd5440814c26c129b05a53c9eeb1bb3978f7100776f2d6d0193ssdeep: 1536:DOmv//ZOsSdi2cY2AcMxoL2mfxGDw5OMkVQ0YTGEqn/pg+Izmd:BXZOTdPcMxoGeFOQ0YTGXn/pNUGtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

PWS:Win32/PrimaryPass.AD!MTB also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	DeepScan:Generic.MSIL.PasswordStealerA.10958B49
FireEye	Generic.mg.cc08084a09b75ba5
CAT-QuickHeal	Trojan.Mauvaise.SL1
Qihoo-360	HEUR/QVM20.1.44A7.Malware.Gen
ALYac	DeepScan:Generic.MSIL.PasswordStealerA.10958B49
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_80% (D)
BitDefender	DeepScan:Generic.MSIL.PasswordStealerA.10958B49
TrendMicro	TSPY_LOKI.SMA
Cyren	W32/S-f2ff7de9!Eldorado
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:LokiBot-A [Trj]
ClamAV	Win.Trojan.naKocTb-6331389-1
NANO-Antivirus	Trojan.Win32.Renos.flotpm
Ad-Aware	DeepScan:Generic.MSIL.PasswordStealerA.10958B49
TACHYON	Trojan/W32.naKocTb.106496
F-Secure	Trojan.TR/Crypt.XPACK.Gen
DrWeb	Trojan.PWS.Siggen2.59088
Invincea	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Emsisoft	Trojan-PSW.Fareit (A)
Ikarus	Trojan-Spy.Primarypass
Avira	TR/Crypt.XPACK.Gen
Microsoft	PWS:Win32/PrimaryPass.AD!MTB
Gridinsoft	Malware.Win32.Pack.39734!se
Arcabit	DeepScan:Generic.MSIL.PasswordStealerA.10958B49
GData	DeepScan:Generic.MSIL.PasswordStealerA.10958B49
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.naKocTb.R270234
Acronis	suspicious
McAfee	LokiBot!CC08084A09B7
MAX	malware (ai score=82)
VBA32	BScope.Trojan.Agentb
Malwarebytes	Spyware.LokiBot
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/PSW.Fareit.L
TrendMicro-HouseCall	TSPY_LOKI.SMA
Rising	Stealer.Agent!1.CA9B (CLASSIC)
Yandex	Trojan.GenAsa!SBszS2bfSB0
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_96%
Fortinet	W32/GenKryptik.DYST!tr
BitDefenderTheta	AI:Packer.59A658E51E
AVG	Win32:LokiBot-A [Trj]
Cybereason	malicious.a09b75
MaxSecure	Trojan.Malware.300983.susgen