Spy

Spyware.Danabot.A removal

Malware Removal

The Spyware.Danabot.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Spyware.Danabot.A virus can do?

  • Executable code extraction
  • Possible date expiration check, exits too soon after checking local time
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (6 unique times)
  • The binary likely contains encrypted or compressed data.
  • Creates a hidden or system file

How to determine Spyware.Danabot.A?


File Info:

crc32: E39595BB
md5: 565a67a6dff8d567038d9fe8c7fa0024
name: dan777.exe
sha1: a3f8c5b142a8fbeb72664d521dfe91e4939eaffe
sha256: de146c4ebb0ba2850b93cb358f78b671f50724c9710127d6755c1c2f2f23d698
sha512: f075b5ebf4ff35ce85ba5cf15ebfb3da760a67daa23c294545630c1d1a62d02a5282c5a24b82fd9fc5285ce68b6e6b79185c6e8812e882a058ae3ee3ca555022
ssdeep: 24576:moZ2QdrMlmBT/cCpqq7Isc8/CQOpWAFpIpAHKsLzEoyKKeLSqTuucOJ0CxbvYAu:mZIauzJw93ogtLZTKuh1puHihU+div
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Spyware.Danabot.A also known as:

DrWebTrojan.PWS.DanaBot.214
MicroWorld-eScanTrojan.GenericKD.41900752
CAT-QuickHealTrojan.Randet
McAfeeGenericRXIR-BE!565A67A6DFF8
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforMalware
K7AntiVirusTrojan ( 00557eeb1 )
AlibabaTrojanDropper:Win32/Danabot.ea2d677b
K7GWTrojan ( 00557eeb1 )
CrowdStrikewin/malicious_confidence_90% (W)
ArcabitTrojan.Generic.D27F5AD0
Invinceaheuristic
BitDefenderThetaGen:NN.ZelphiF.32515.tUW@a076Mfli
CyrenW32/Danabot.E.gen!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win32/TrojanDropper.Danabot.R
APEXMalicious
AvastWin32:Trojan-gen
KasperskyUDS:DangerousObject.Multi.Generic
BitDefenderTrojan.GenericKD.41900752
NANO-AntivirusTrojan.Win32.Danabot.gbutop
RisingDropper.Danabot!8.FAFD (TFE:5:YDTWPJLcCSM)
Endgamemalicious (high confidence)
EmsisoftTrojan.GenericKD.41900752 (B)
ComodoMalware@#1yrvhvzu9mlrr
F-SecureHeuristic.HEUR/AGEN.1043978
ZillyaDropper.Danabot.Win32.200
TrendMicroTROJ_GEN.R002C0PJ419
McAfee-GW-EditionBehavesLike.Win32.Fareit.vc
FortinetW32/Danabot.R!tr
FireEyeGeneric.mg.565a67a6dff8d567
SophosMal/Generic-S
IkarusTrojan-Dropper.Win32.Danabot
F-ProtW32/Danabot.E.gen!Eldorado
WebrootW32.Danabot
AviraHEUR/AGEN.1043978
MAXmalware (ai score=84)
MicrosoftTrojan:Win32/Occamy.C
ZoneAlarmUDS:DangerousObject.Multi.Generic
AhnLab-V3Trojan/Win32.Danabot.R295979
Acronissuspicious
VBA32TrojanBanker.Danabot
ALYacSpyware.Danabot.A
Ad-AwareTrojan.GenericKD.41900752
PandaTrj/GdSda.A
TrendMicro-HouseCallTROJ_GEN.R002C0PJ419
YandexTrojan.DR.Danabot!
GDataTrojan.GenericKD.41900752
AVGWin32:Trojan-gen
Cybereasonmalicious.142a8f
Paloaltogeneric.ml
Qihoo-360HEUR/QVM05.1.537B.Malware.Gen

How to remove Spyware.Danabot.A?

Spyware.Danabot.A removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment