What is "Trojan-Banker.Win32.RTM.gsh"?

The Trojan-Banker.Win32.RTM.gsh is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Banker.Win32.RTM.gsh virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan-Banker.Win32.RTM.gsh?


File Info:
crc32: D8BA5B17
md5: dd2081afbc2239e80ec5c8b583d9b735
name: DD2081AFBC2239E80EC5C8B583D9B735.mlw
sha1: 64b6abec30094a90a512f2c49ce0b7a784c369e8
sha256: 90289056c65a296c4920956b8dcde767b13b30d42bd1dbcdd3d7dcd59ff15906
sha512: 154c4677144f73f7cfa8f4d1ebc9733d0dee3089509bb45c6def181c4c52f22cddb69875148f14a7eee06fb6bbed2aa2b4d77f79fea54264f3fa1aaa4f885b95
ssdeep: 6144:XO+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHdh:+kvIfnMs596S9h
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Trojan-Banker.Win32.RTM.gsh also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.45144756
FireEye	Generic.mg.dd2081afbc2239e8
ALYac	Trojan.GenericKD.45144756
Sangfor	Malware
K7AntiVirus	Spyware ( 0040f0131 )
BitDefender	Trojan.GenericKD.45144756
K7GW	Spyware ( 0040f0131 )
CrowdStrike	win/malicious_confidence_90% (D)
BitDefenderTheta	Gen:NN.ZedlaF.34700.AE4@aWrZL@ki
ESET-NOD32	a variant of Win32/Kryptik.HIKD
APEX	Malicious
Kaspersky	Trojan-Banker.Win32.RTM.gsh
Rising	Trojan.Kryptik!8.8 (TFE:2:ItOo6ejRx2)
Ad-Aware	Trojan.GenericKD.45144756
Sophos	ML/PE-A + Mal/EncPk-APV
McAfee-GW-Edition	BehavesLike.Win32.Android.vz
Emsisoft	Trojan.GenericKD.45144756 (B)
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Qakbot.GP!MTB
Arcabit	Trojan.Generic.D2B0DAB4
ZoneAlarm	Trojan-Banker.Win32.RTM.gsh
GData	Trojan.GenericKD.45144756
Cynet	Malicious (score: 100)
McAfee	GenericRXNC-SV!DD2081AFBC22
MAX	malware (ai score=89)
VBA32	BScope.Backdoor.Qbot
Cylance	Unsafe
Panda	Trj/GdSda.A
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	W32/Kryptik.HDNN!tr
Qihoo-360	HEUR/QVM40.1.29AE.Malware.Gen

How to remove Trojan-Banker.Win32.RTM.gsh?

Trojan-Banker.Win32.RTM.gsh removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “Trojan-Banker.Win32.RTM.gsh”?