Trojan-Banker.Win32.Qbot.oeb malicious file

The Trojan-Banker.Win32.Qbot.oeb is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan-Banker.Win32.Qbot.oeb virus can do?

Executable code extraction
Creates RWX memory
A process created a hidden window
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality

How to determine Trojan-Banker.Win32.Qbot.oeb?


File Info:
crc32: CF782A5F
md5: 7ce93e540de95b4153b953b9070d6f36
name: vvvv.exe
sha1: 2909fe83cc2754daa8223c40e0f9d2cc8291ee4f
sha256: ffb5d8c941c81435ec6998e1edb72a0c3224158a87451975ecd201c11bdb4b85
sha512: 814a003b80a107582721be7a21903f31104b9d0499a4a233508c28601ac21c94c52c87c63f7411798aef838cb0b7cb7a59b208b1289fa1bbfed96af6330b0fe2
ssdeep: 12288:pli+DBCYyRl9iIgMw6T+etB7T2B5ZTzFxOUgx:9yGTxOUc
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2002-2008 Mark Russinovich and Bryce Cogswell
InternalName: Ercihhdsewee Rtrssiet
FileVersion: 0.03
CompanyName: Sysinternals - www.sysinternals.com
ProductName: Ercihhdsewee rtrssiet
ProductVersion: 0.03
FileDescription: Autostart program viewer
OriginalFilename: ercihhds.exe
Translation: 0x0409 0x04b0

Trojan-Banker.Win32.Qbot.oeb also known as:

DrWeb	Trojan.PWS.Spy.21405
MicroWorld-eScan	Trojan.GenericKD.33050639
FireEye	Generic.mg.7ce93e540de95b41
ALYac	Trojan.Agent.Occamy.A
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Malicious.4!c
K7AntiVirus	Trojan ( 0055fb991 )
BitDefender	Trojan.GenericKD.33050639
K7GW	Trojan ( 0055fb991 )
Cybereason	malicious.3cc275
TrendMicro	TROJ_GEN.R011C0WB820
BitDefenderTheta	Gen:NN.ZexaF.34090.yq0@aC1TPYci
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
GData	Trojan.GenericKD.33050639
Kaspersky	Trojan-Banker.Win32.Qbot.oeb
Alibaba	TrojanBanker:Win32/Kryptik.fbec2688
Tencent	Win32.Trojan-banker.Qbot.Ammr
Ad-Aware	Trojan.GenericKD.33050639
Sophos	Troj/Qbot-FA
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.PUPXAA.fc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.33050639 (B)
Ikarus	Trojan.Win32.Crypt
Cyren	W32/Trojan.UOCX-5857
MAX	malware (ai score=82)
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D1F8500F
ZoneAlarm	Trojan-Banker.Win32.Qbot.oeb
Microsoft	Trojan:Win32/Occamy.C
Acronis	suspicious
McAfee	RDN/Generic.grp
Malwarebytes	Backdoor.Qbot
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HAXG
TrendMicro-HouseCall	TROJ_GEN.R011C0WB820
Rising	Trojan.Generic@ML.93 (RDMK:CSZmxMizRxbjfeasUS9AiA)
SentinelOne	DFI – Malicious PE
Fortinet	W32/Kryptik.HAXG!tr
Webroot	W32.Trojan.Gen
AVG	Win32:BankerX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_70% (W)
Qihoo-360	Generic/HEUR/QVM10.2.142F.Malware.Gen

How to remove Trojan-Banker.Win32.Qbot.oeb?

Trojan-Banker.Win32.Qbot.oeb removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X