Trojan

About “Trojan-Banker.Win32.RTM.hwa” infection

Malware Removal

The Trojan-Banker.Win32.RTM.hwa is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan-Banker.Win32.RTM.hwa virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process created a hidden window
  • Uses Windows utilities for basic functionality
  • Executed a process and injected code into it, probably while unpacking
  • Installs itself for autorun at Windows startup
  • Anomalous binary characteristics

How to determine Trojan-Banker.Win32.RTM.hwa?



File Info:

crc32: EB7F7655
md5: d44a12600e1e9b7803c6b41b9f61be08
name: D44A12600E1E9B7803C6B41B9F61BE08.mlw
sha1: 7d11f487d1c989a61a12a36166c6139856110fb7
sha256: ecda3286604be83375a531fb5abc15a6c55d03a015e643a9aa9ed40b58a8e689
sha512: a166e3593dbad164b645c2eab0f3ef770338a8fae42dcf8d2a379306218e95d3d34aa3f7713dbdb9ee371787b434346c18200e45ee3c6097e663ef3bf327a718
ssdeep: 6144:Mvm+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHdFavy:tkvIfnMs596S9Favy
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows


Version Info:

LegalCopyright: Copyright xa9 2016
InternalName: Java Control Panel
FileVersion: 11.121.2.13
Full Version: 11.121.2.13
CompanyName: Oracle Corporation
ProductName: Java(TM) Platform SE 8 U121
ProductVersion: 8.0.1210.13
FileDescription: Java Control Panel
OriginalFilename: javacpl.exe
Translation: 0x0409 0x04b0

Trojan-Banker.Win32.RTM.hwa also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.35942034
FireEyeGeneric.mg.d44a12600e1e9b78
McAfeeGenericRXNE-LU!D44A12600E1E
CylanceUnsafe
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKD.35942034
K7GWRiskware ( 0040eff71 )
CrowdStrikewin/malicious_confidence_70% (D)
CyrenW32/Trojan.PFFK-2965
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:BankerX-gen [Trj]
KasperskyTrojan-Banker.Win32.RTM.hwa
AlibabaTrojanBanker:Win32/Kryptik.3175ff86
AegisLabHacktool.Win32.Krap.lKMc
Ad-AwareTrojan.GenericKD.35942034
SophosMal/Generic-R + Mal/EncPk-APV
F-SecureTrojan.TR/Crypt.Agent.jifnc
DrWebTrojan.Inject4.6403
TrendMicroTROJ_GEN.R002C0RLV20
McAfee-GW-EditionArtemis!Trojan
EmsisoftTrojan.GenericKD.35942034 (B)
JiangminTrojan.Banker.RTM.vh
AviraTR/Crypt.Agent.jifnc
MAXmalware (ai score=88)
Antiy-AVLGrayWare/Win32.Kryptik.ehls
MicrosoftProgram:Win32/Ymacco.AAEC
GridinsoftTrojan.Win32.Downloader.oa
ArcabitTrojan.Generic.D2246E92
ZoneAlarmTrojan-Banker.Win32.RTM.hwa
GDataTrojan.GenericKD.35942034
CynetMalicious (score: 100)
BitDefenderThetaGen:NN.ZedlaF.34700.ww8@a0yu68fi
ALYacTrojan.GenericKD.35942034
VBA32BScope.Trojan.Diple
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/Kryptik.HILY
TrendMicro-HouseCallTROJ_GEN.R002C0RLV20
RisingMalware.Obscure/Heur!1.A89E (CLASSIC)
IkarusTrojan.Win32.Crypt
eGambitUnsafe.AI_Score_95%
FortinetW32/Kryptik.HIDC!tr
AVGWin32:BankerX-gen [Trj]
Paloaltogeneric.ml

How to remove Trojan-Banker.Win32.RTM.hwa?

Trojan-Banker.Win32.RTM.hwa removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment