Categories: Malware

Should I remove “PWS:Win32/Tibia.BI”?

The PWS:Win32/Tibia.BI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Tibia.BI virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Unconventionial binary language: Polish
Unconventionial language used in binary resources: Polish
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Creates a copy of itself

How to determine PWS:Win32/Tibia.BI?


File Info:
name: C9294307BEC4DF53E5EA.mlwpath: /opt/CAPEv2/storage/binaries/7f7a498d1cb64b18f11265473284afc568a658656b4461525811fd75289253e9crc32: 0181656Fmd5: c9294307bec4df53e5ea5cd2adcbb55bsha1: 4bb0b4836d9eb96db34579db1ff60532c6db5013sha256: 7f7a498d1cb64b18f11265473284afc568a658656b4461525811fd75289253e9sha512: fdd05b694e8353fee83a71567ca1a0f77cc4d2971c3063867d731668ceabd1b9fa43ebd114abdb1ce919c40b72d472d76232fd8373afbf0f163aad933c867457ssdeep: 24576:JSe0XiUx5l29ppPJQ7eCBsSOKoQSdKrq61MNNOJ/tXMNCevwEyMjX:4IaJWSIQSgr/1JfMjXtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B5B56B12A681513FD867173A496BA25CDC3B7A392E5AAC4F6EF4884C0E3D7403D3D687sha3_384: e3d164d42dc47bcd88f77b6fd19056ea5e0fa9e1667e74f2ebf08cc9e45b66dea342f0eb3318d26d0de7ad4567dd26dbep_bytes: 558bec83c4f0b8046e5200e8ecd2edfftimestamp: 2011-02-02 12:10:44
Version Info:
CompanyName: FileDescription: system ControllFileVersion: 1.2.6.0InternalName: LegalCopyright: LegalTrademarks: OriginalFilename: ProductName: ProductVersion: 1.0.0.0Comments: Translation: 0x0415 0x04e2

PWS:Win32/Tibia.BI also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agentb.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ulise.353370
ClamAV	Win.Trojan.5454489-1
FireEye	Generic.mg.c9294307bec4df53
Skyhigh	BehavesLike.Win32.Pate.vt
ALYac	Gen:Variant.Ulise.353370
Cylance	unsafe
Zillya	Trojan.Scar.Win32.41827
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	TrojanPSW:Win32/Tibia.0ac1df8b
K7GW	Riskware ( 0015e4f11 )
K7AntiVirus	Riskware ( 0015e4f11 )
BitDefenderTheta	Gen:NN.ZelphiF.36744.oQ3@aiV7yYjO
VirIT	Trojan.Win32.Generic.CUR
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/PSW.Tibia.NEJ
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Agentb.gen
BitDefender	Gen:Variant.Ulise.353370
NANO-Antivirus	Trojan.Win32.Scar.brmkwx
Avast	Win32:Agent-AVGV [Trj]
Tencent	Malware.Win32.Gencirc.115ba100
Emsisoft	Gen:Variant.Ulise.353370 (B)
F-Secure	Trojan.TR/Scar.dmya
DrWeb	Trojan.Siggen6.42945
VIPRE	Gen:Variant.Ulise.353370
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Scar
GData	Gen:Variant.Ulise.353370
Jiangmin	Trojan/Scar.aexa
Webroot	W32.Trojan.Scar.Dmya
Google	Detected
Avira	TR/Scar.dmya
Antiy-AVL	Trojan/Win32.Scar
Kingsoft	Win32.Trojan.Agentb.gen
Xcitium	Suspicious@#14g0gxwkwrctk
Arcabit	Trojan.Ulise.D5645A
ZoneAlarm	HEUR:Trojan.Win32.Agentb.gen
Microsoft	PWS:Win32/Tibia.BI
McAfee	Artemis!C9294307BEC4
MAX	malware (ai score=98)
VBA32	BScope.TrojanPSW.Tibia
Rising	Stealer.Tibia!8.2E0 (TFE:4:GdZVBMNrkNI)
Yandex	Trojan.GenAsa!rty+WBeBWtk
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.7164915.susgen
Fortinet	W32/Tibia.NDB!tr
AVG	Win32:Agent-AVGV [Trj]
DeepInstinct	MALICIOUS