What is “Trojan-Spy.Win32.Noon.aqco”?

The Trojan-Spy.Win32.Noon.aqco is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan-Spy.Win32.Noon.aqco virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan-Spy.Win32.Noon.aqco?


File Info:
crc32: CBE1285F
md5: b39c603a598df9598964706b986d2a57
name: kafox.txt
sha1: 374be70ecfa18e90a6accb2e5c815ef2caa2165b
sha256: 9d33f3f45bcb7e8d173748a0f4bdf0427254193f138a97590c85a8dfe35e2009
sha512: 2dfec3e62c8cb10573938027272effc297a84725523339c97b53db244e35b9de3db68be0dc3ca84e1fa69583e1f3561353f894a5dc9228b40b2ec47409a5c30d
ssdeep: 6144:oMs2PHMCOL6gzWCSQmcG5r1aBqa4S9lk6tBHhiPKQJAWJNryMkC4tAxAtAv:lPMC3gkraBP5ljtTzCcO
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
InternalName: CONTRATTo
FileVersion: 1.05.0003
CompanyName: aSUS
ProductName: rehesO
ProductVersion: 1.05.0003
OriginalFilename: CONTRATTo.exe

Trojan-Spy.Win32.Noon.aqco also known as:

DrWeb	Trojan.Inject3.30593
MicroWorld-eScan	Gen:Heur.PonyStealer.Gm0@jaNQXkai
FireEye	Generic.mg.b39c603a598df959
CAT-QuickHeal	Trojan.Wacatac
McAfee	Fareit-FQK!B39C603A598D
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.PonyStealer.4!c
K7AntiVirus	Trojan ( 0055b4ac1 )
BitDefender	Gen:Heur.PonyStealer.Gm0@jaNQXkai
K7GW	Trojan ( 0055b4ac1 )
Cybereason	malicious.ecfa18
BitDefenderTheta	Gen:NN.ZevbaF.32515.Gm0@aaNQXkai
F-Prot	W32/VBKrypt.ACX.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:CrypterX-gen [Trj]
GData	Gen:Heur.PonyStealer.Gm0@jaNQXkai
Kaspersky	Trojan-Spy.Win32.Noon.aqco
Alibaba	TrojanSpy:Win32/Noon.d7b91083
NANO-Antivirus	Trojan.Win32.Inject3.ghxcui
ViRobot	Trojan.Win32.Z.Ponystealer.536576.AE
Ad-Aware	Gen:Heur.PonyStealer.Gm0@jaNQXkai
Sophos	Mal/FareitVB-X
Comodo	Malware@#1eqsbb82tiizt
F-Secure	Trojan.TR/Injector.qhuyf
TrendMicro	TROJ_GEN.R002C0RKE19
Ikarus	Trojan.VB.Crypt
Cyren	W32/VBKrypt.ACX.gen!Eldorado
Webroot	W32.Trojan.Gen
Avira	TR/Injector.qhuyf
MAX	malware (ai score=100)
Endgame	malicious (high confidence)
Arcabit	Trojan.PonyStealer.ED109B9
ZoneAlarm	Trojan-Spy.Win32.Noon.aqco
Microsoft	Trojan:Win32/Tiggre!rfn
AhnLab-V3	Trojan/Win32.Kryptik.R298717
Acronis	suspicious
ALYac	Gen:Heur.PonyStealer.Gm0@jaNQXkai
Malwarebytes	Trojan.MalPack.VB
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Injector.EIWH
TrendMicro-HouseCall	TROJ_GEN.R002C0RKE19
Yandex	Trojan.Injector!hmppqFemF84
SentinelOne	DFI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Injector.EIVP!tr
AVG	Win32:CrypterX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	HEUR/QVM03.0.3ACD.Malware.Gen

How to remove Trojan-Spy.Win32.Noon.aqco?

Trojan-Spy.Win32.Noon.aqco removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X