Categories: Trojan

What is “Trojan-Banker.Win32.RTM.eoq”?

The Trojan-Banker.Win32.RTM.eoq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Banker.Win32.RTM.eoq virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Installs itself for autorun at Windows startup
Anomalous binary characteristics

How to determine Trojan-Banker.Win32.RTM.eoq?


File Info:
crc32: 08071782md5: c62e05c9e2cbdde76710544f3ba3ad6bname: C62E05C9E2CBDDE76710544F3BA3AD6B.mlwsha1: aec07a54fefb50eb42d753c272ea453b1c42b7acsha256: bc49a8aff45f0818cdd25ab0309f9457de1ddb6877cf2f39f02ccd3f956ee285sha512: 66f825fa8232ae81a19a9699d5b53b04132994778fa874dee832500d886d0c248f37b116c2269e9ab54209e1b870cd02f72072dec31e1046ed62c4119533123cssdeep: 3072:8ZxPXWHms5JbMUEy69jqQ4Cb/H/4mi84tgVchKKJeWuZ:8vXWHm3UErOQHz/4IHitype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (c) 2003-2016 Glarysoft LtdInternalName: FileEncrypt.exeFileVersion: 5, 0, 0, 35CompanyName: Glarysoft LtdProductName: Glary UtilitiesProductVersion: 5.0.0.1FileDescription: File Encrypter and DecrypterOriginalFilename: FileEncrypt.exeTranslation: 0x0804 0x03a8

Trojan-Banker.Win32.RTM.eoq also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.Inject4.6112
MicroWorld-eScan	Trojan.GenericKD.35554206
FireEye	Generic.mg.c62e05c9e2cbdde7
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Spyware ( 0040f0131 )
BitDefender	Trojan.GenericKD.35554206
K7GW	Spyware ( 0040f0131 )
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	Gen:NN.ZedlaF.34670.eM8@aivZ30lj
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	Trojan-Banker.Win32.RTM.eoq
Rising	Trojan.Kryptik!8.8 (TFE:5:67eOwHUbRhE)
Ad-Aware	Trojan.GenericKD.35554206
Emsisoft	Trojan.GenericKD.35554206 (B)
F-Secure	Heuristic.HEUR/AGEN.1139560
McAfee-GW-Edition	BehavesLike.Win32.Dropper.vt
Sophos	ML/PE-A + Mal/EncPk-APV
Avira	HEUR/AGEN.1139560
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Qakbot.AVP!MTB
Arcabit	Trojan.Generic.D21E839E
ZoneAlarm	Trojan-Banker.Win32.RTM.eoq
GData	Trojan.GenericKD.35554206
Cynet	Malicious (score: 100)
McAfee	GenericRXMV-OD!C62E05C9E2CB
MAX	malware (ai score=87)
VBA32	BScope.Trojan.Encoder
ESET-NOD32	a variant of Win32/GenKryptik.EXVO
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_79%
Fortinet	W32/Kryptik.HDNN!tr
Qihoo-360	HEUR/QVM40.1.B8AB.Malware.Gen