Trojan

What is “Trojan-Banker.Win32.Emotet.fmsw”?

Malware Removal

The Trojan-Banker.Win32.Emotet.fmsw is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Banker.Win32.Emotet.fmsw virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Mimics the system’s user agent string for its own requests
  • Expresses interest in specific running processes
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Attempts to modify proxy settings

How to determine Trojan-Banker.Win32.Emotet.fmsw?


File Info:

crc32: D7C6ED96
md5: 9daf40c893d3d4dd701b4d136de1f907
name: upload_file
sha1: 5277e3b5762c70a0c606eee443b65aba662a4723
sha256: eec878c1eda75633655139e90ac716da292366f4bffbb5f1e866a9b80d9ff7d9
sha512: 786a9a53900b00102bdab5b1b059f031a40f21480e8ec62cabced81b8ce9ea5304e9730b6b199eb1c620a7a27c0c14c80c85fabd9f2c0142bf8f4fc8d76644b0
ssdeep: 6144:2sAXvtkXZjPfQ72jfw9LZ3fUIKonW1WAEgjrqVebiQ6OiW:2ZftkJjXCU8Z3cfoIEqb6
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2002
InternalName: DriveBrowsingTree
FileVersion: 1, 0, 0, 1
CompanyName:
LegalTrademarks:
ProductName: DriveBrowsingTree Application
ProductVersion: 1, 0, 0, 1
FileDescription: DriveBrowsingTree MFC Application
OriginalFilename: DriveBrowsingTree.EXE
Translation: 0x0409 0x04b0

Trojan-Banker.Win32.Emotet.fmsw also known as:

BkavW32.AIDetectVM.malware2
MicroWorld-eScanTrojan.GenericKDZ.69173
FireEyeGeneric.mg.9daf40c893d3d4dd
ALYacTrojan.GenericKDZ.69173
CylanceUnsafe
AegisLabTrojan.Win32.Emotet.L!c
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKDZ.69173
K7GWRiskware ( 0040eff71 )
TrendMicroTROJ_GEN.R002C0DH220
CyrenW32/Emotet.AOG.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HFHN
APEXMalicious
Paloaltogeneric.ml
GDataTrojan.GenericKDZ.69173
KasperskyTrojan-Banker.Win32.Emotet.fmsw
AlibabaTrojan:Win32/Emotet.fcb6ec12
NANO-AntivirusTrojan.Win32.Kryptik.hpnoph
ViRobotTrojan.Win32.Emotet.401408.D
TencentMalware.Win32.Gencirc.10cde567
Ad-AwareTrojan.GenericKDZ.69173
SophosTroj/Emotet-CKO
F-SecureTrojan.TR/Crypt.Agent.rlkma
DrWebTrojan.DownLoader34.14215
ZillyaBackdoor.Emotet.Win32.847
Invinceaheuristic
EmsisoftTrojan.Emotet (A)
IkarusTrojan-Banker.Emotet
F-ProtW32/Emotet.AOG.gen!Eldorado
JiangminBackdoor.Emotet.pm
WebrootW32.Trojan.Emotet
AviraTR/Crypt.Agent.rlkma
MAXmalware (ai score=89)
Antiy-AVLTrojan/Win32.SGeneric
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D10E35
AhnLab-V3Trojan/Win32.Emotet.R346631
ZoneAlarmTrojan-Banker.Win32.Emotet.fmsw
MicrosoftTrojan:Win32/Emotet.DGM!MTB
CynetMalicious (score: 85)
McAfeeEmotet-FRO!9DAF40C893D3
TACHYONBanker/W32.Emotet.401408.R
VBA32BScope.Trojan.Emotet
MalwarebytesTrojan.Emotet
PandaTrj/Genetic.gen
TrendMicro-HouseCallTROJ_GEN.R002C0DH220
RisingTrojan.Kryptik!1.C82B (CLOUD)
FortinetW32/GenKryptik.EPAZ!tr
AVGWin32:Malware-gen
AvastWin32:Malware-gen
Qihoo-360Win32/Trojan.da2

How to remove Trojan-Banker.Win32.Emotet.fmsw?

Trojan-Banker.Win32.Emotet.fmsw removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment