Trojan

Trojan-Banker.Win32.Trickster.dvm (file analysis)

Malware Removal

The Trojan-Banker.Win32.Trickster.dvm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Banker.Win32.Trickster.dvm virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Unconventionial language used in binary resources: Kashmiri (Sasia)
  • The binary likely contains encrypted or compressed data.
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Attempts to stop active services
  • Creates a copy of itself
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Trojan-Banker.Win32.Trickster.dvm?


File Info:

crc32: AA2B9526
md5: ec56348b4914bbb323daa9c3e548b180
name: EC56348B4914BBB323DAA9C3E548B180.mlw
sha1: e098c5dd78d29bdd3d0e55aaec617dd0cebb6ff4
sha256: aa31a0a4ae6272ad89ee2a0c40030817a110603c15a1763e84246f067e7a0725
sha512: ef746f4afda1e73252fa4d5e4d80fc2b71f8ac0fce98608eb6ee2666494bb6905817f8055e93b1d6192f6f463fcdf44519006c8152800d0a039987e60bbf3947
ssdeep: 6144:23AlIFnnjWbJoL+nrlPvZMq6b3fJxPzzQI9unfU2Pkn3pAD+pWe3k7VvpbmZSt/w:23DnfqnBvex3fbPgYszyp19k5vlL4
type: MS-DOS executable

Version Info:

Translation: 0x0409 0x04b0
InternalName: Project1
FileVersion: 1.0.0.0
CompanyName: Rila
Comments: filter to a picture
ProductName: Add a color filter to a picture
ProductVersion: 1.0.0.0
FileDescription: few lines of code you can simply add a color
OriginalFilename: Project1.exe

Trojan-Banker.Win32.Trickster.dvm also known as:

K7AntiVirusTrojan ( 005500991 )
LionicTrojan.Win32.Trickster.4!c
DrWebTrojan.Inject3.17148
ALYacTrojan.GenericKD.32054145
MalwarebytesTrojan.TrickBot
ZillyaTrojan.TrickBot.Win32.264
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojanBanker:Win32/Trickster.8f815d6c
K7GWTrojan ( 005500991 )
Cybereasonmalicious.b4914b
CyrenW32/Downloader.LAFE-6107
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/TrickBot.CJ
ZonerTrojan.Win32.80453
APEXMalicious
AvastOther:Malware-gen [Trj]
CynetMalicious (score: 100)
KasperskyTrojan-Banker.Win32.Trickster.dvm
BitDefenderTrojan.GenericKD.32054145
NANO-AntivirusTrojan.Win32.Trickster.friran
MicroWorld-eScanTrojan.GenericKD.32054145
TencentWin32.Trojan-banker.Trickster.Alsg
Ad-AwareTrojan.GenericKD.32054145
SophosMal/Generic-R + Troj/VB-KGT
ComodoMalware@#1e8eu7yq47ooa
BitDefenderThetaGen:NN.ZevbaF.34266.Jm0@aK3SPEcQ
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Generic.hh
FireEyeGeneric.mg.ec56348b4914bbb3
EmsisoftTrojan.GenericKD.32054145 (B)
SentinelOneStatic AI – Malicious PE
WebrootW32.Trojan.Gen
AviraTR/TrickBot.cin
Antiy-AVLTrojan/Generic.ASMalwS.2BE9613
MicrosoftTrojan:Win32/Skeeyah.A!MTB
ZoneAlarmTrojan-Banker.Win32.Trickster.dvm
GDataWin32.Malware.DelWindef.RP4AY2
TACHYONBanker/W32.VB-Trickster.573440
AhnLab-V3Trojan/Win32.Agent.R300040
McAfeeGeneric.bto
PandaTrj/WLT.E
YandexTrojan.PWS.Trickster!PUT+zFW/kq0
IkarusTrojan.SuspectCRC
MaxSecureTrojan.Malware.74384400.susgen
FortinetW32/Trickster.DVM!tr
AVGOther:Malware-gen [Trj]
Paloaltogeneric.ml

How to remove Trojan-Banker.Win32.Trickster.dvm?

Trojan-Banker.Win32.Trickster.dvm removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment