Categories: Trojan

Trojan.Banker.AR removal instruction

The Trojan.Banker.AR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Banker.AR virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Unconventionial language used in binary resources: Portuguese (Brazilian)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Installs itself for autorun at Windows startup
Anomalous binary characteristics

How to determine Trojan.Banker.AR?


File Info:
name: 92DF7A040475F59E630D.mlwpath: /opt/CAPEv2/storage/binaries/a921da91e8afad6f1e7c04efc269f44b7b91b58b5c1bcc0f8bdd5cc60ab99eafcrc32: 92300D82md5: 92df7a040475f59e630d177546d29b65sha1: 69a8e51e732cdf4dca8c0243ad7dec24d6ff4d99sha256: a921da91e8afad6f1e7c04efc269f44b7b91b58b5c1bcc0f8bdd5cc60ab99eafsha512: cd3a210eb5d153f95e9a50bff3d5b18d87aff089caa9688f87b4bfd1a766c9b2a50530f229db217d41453670bdc7209c052971cc11129e777e31e6166c62ea6dssdeep: 3072:w//ssvUGO9kP7jo1yLD/39jj+B667ECRAakFxqIgLJ:w/Esvvz7LliBz7fRABvqI4type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T19FE312F827A69811C496D037D3521F86062F5979EB0ACF044BFEF92F0C5EBA12742827sha3_384: df19b13a2781eaa044429dfa5292a6e08ae61c0a31aa05912696c701c117211a560e3e07ce32807324e184b0ab2604aeep_bytes: 60be00d043008dbe0040fcffc7870ce7timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Trojan.Banker.AR also known as:

Bkav	W32.AIDetect.malware2
DrWeb	Trojan.PWS.Banker.187
MicroWorld-eScan	Trojan.Banker.AR
FireEye	Generic.mg.92df7a040475f59e
ALYac	Trojan.Banker.AR
Cylance	Unsafe
Zillya	Trojan.Banker.Win32.88055
BitDefenderTheta	Gen:NN.ZelphiF.34084.jmHfa0az5@cG
Cyren	W32/Bancos.ODBF-0828
Symantec	Infostealer.Banpaes
ESET-NOD32	Win32/Spy.Banker.BR
ClamAV	Html.Trojan.BankerAR-2
Kaspersky	not-a-virus:HEUR:AdWare.Win32.Generic
BitDefender	Trojan.Banker.AR
NANO-Antivirus	Trojan.Win32.Banker.bnbqa
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.Banker.AR
Emsisoft	Application.Downloader (A)
Comodo	TrojWare.Win32.Spy.Banker.BR@1o2o
McAfee-GW-Edition	Generic.da
SentinelOne	Static AI – Suspicious PE
GData	Trojan.Banker.AR
Jiangmin	TrojanSpy.Banker.hua
eGambit	Unsafe.AI_Score_98%
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Generic.ASMalwS.36D39
Arcabit	Trojan.Banker.AR
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Banker.C16401
McAfee	Generic.da
VBA32	TScope.Trojan.Delf
APEX	Malicious
Rising	Trojan.Spy.Banker.bye (CLASSIC)
Yandex	Trojan.Bancos!5c1ggAg2O2o
Ikarus	Trojan-Banker.Win32.Banker
MaxSecure	Trojan.Malware.29752.susgen
AVG	Win32:Trojan-gen
Cybereason	malicious.40475f