Trojan-Banker.Win32.RTM.gps (file analysis)

The Trojan-Banker.Win32.RTM.gps is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Banker.Win32.RTM.gps virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan-Banker.Win32.RTM.gps?


File Info:
crc32: DE1ABD37
md5: 8ecb3bcee55fa8d661ffb4494d61392e
name: 8ECB3BCEE55FA8D661FFB4494D61392E.mlw
sha1: 46a6341ff832ffe0f6e1fa8ee9256b2dc46f2733
sha256: 6b96eb31dd8d7b598ce9598f979c6ccafc5c7d7b3ef970dc8d42e145cb290f3f
sha512: 4a524fd37ac528569435fa5564b29b2819833be45f78b7b0757b2b9d84c79a739703401b9357677aba8c3a5fecee0f2b7ca0944ced10ef372e07bf9c3dfb2226
ssdeep: 6144:h/+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHd:BkvIfnMs596S9
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Trojan-Banker.Win32.RTM.gps also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.72161
FireEye	Generic.mg.8ecb3bcee55fa8d6
McAfee	W32/PinkSbot-HF!8ECB3BCEE55F
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Trojan.GenericKDZ.72161
K7GW	Spyware ( 0040f0131 )
K7AntiVirus	Spyware ( 0040f0131 )
BitDefenderTheta	Gen:NN.ZedlaF.34700.nE4@aGGHMGli
Cyren	W32/Kryptik.CUW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HIKD
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Trojan-Banker.Win32.RTM.gps
Rising	Trojan.Kryptik!8.8 (TFE:2:ItOo6ejRx2)
Ad-Aware	Trojan.GenericKDZ.72161
Emsisoft	Trojan.GenericKDZ.72161 (B)
McAfee-GW-Edition	BehavesLike.Win32.Trojan.vz
Sophos	ML/PE-A + Mal/EncPk-APV
Jiangmin	Trojan.Banker.RTM.tz
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Wacatac.B!ml
Gridinsoft	Trojan.Win32.Kryptik.oa!s1
Arcabit	Trojan.Generic.D119E1
AhnLab-V3	Trojan/Win32.RL_Generic.R359732
ZoneAlarm	Trojan-Banker.Win32.RTM.gps
GData	Trojan.GenericKDZ.72161
Cynet	Malicious (score: 100)
VBA32	BScope.Backdoor.Qbot
ALYac	Trojan.GenericKDZ.72161
MAX	malware (ai score=82)
Malwarebytes	Trojan.TrickBot
Tencent	Malware.Win32.Gencirc.10ce2b66
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Kryptik.HDNN!tr
AVG	Win32:Trojan-gen
Qihoo-360	HEUR/QVM40.1.2405.Malware.Gen

How to remove Trojan-Banker.Win32.RTM.gps?

Trojan-Banker.Win32.RTM.gps removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan-Banker.Win32.RTM.gps (file analysis)