Categories: Trojan

TrojanDownloader:Win32/Banload.BGW (file analysis)

The TrojanDownloader:Win32/Banload.BGW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Banload.BGW virus can do?

Creates RWX memory
A process attempted to delay the analysis task.
Reads data out of its own binary image
Unconventionial language used in binary resources: Portuguese (Brazilian)
Anomalous binary characteristics

How to determine TrojanDownloader:Win32/Banload.BGW?


File Info:
crc32: 1267DD59md5: 617b473e44b3279c5b5b9eddb47a8431name: 617B473E44B3279C5B5B9EDDB47A8431.mlwsha1: 21b45914cea6c2f7820414e29cbc3f82fe6dca43sha256: ddc6aba5920051af7a0736e934fb92f57fc4c6d3ef6e6c6dd4c53c8fab1fc391sha512: d46147e4c9a195690cc0063206fde51b3b5705064068b5b2e1b2380c0e619a23a3897436c9dfcc28ba2e3d5528ea3d2639558f0a0bcfff963f493636f8502d71ssdeep: 24576:T8lO9GoW5AxMobNeQYP0djNeE6CFtvX5/C4iA29KFlTU+Zp76:TbFzYP0djR6CFtvZiA24TP776type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

TrojanDownloader:Win32/Banload.BGW also known as:

MicroWorld-eScan	Gen:Variant.Symmi.69792
FireEye	Generic.mg.617b473e44b3279c
ALYac	Gen:Variant.Symmi.69792
Cylance	Unsafe
AegisLab	Trojan.Win32.Delf.a!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Variant.Symmi.69792
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.e44b32
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Banker-MYS [Trj]
Kaspersky	Trojan-Downloader.Win32.Delf.kloh
NANO-Antivirus	Trojan.Win32.Delf.elcmjv
Rising	Trojan.Generic@ML.96 (RDML:GpBllUjUFsmUEbwZMZe2Qg)
Ad-Aware	Gen:Variant.Symmi.69792
Emsisoft	Gen:Variant.Symmi.69792 (B)
Comodo	TrojWare.Win32.TrojanDownloader.Banload.DAQ@61edgs
F-Secure	Heuristic.HEUR/AGEN.1118020
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_BANLOAD.YWNST
McAfee-GW-Edition	BehavesLike.Win32.Dropper.th
Sophos	Mal/Generic-S
Ikarus	Trojan-Downloader.Win32.Banload
Avira	HEUR/AGEN.1118020
Antiy-AVL	Trojan/Win32.AGeneric
Microsoft	TrojanDownloader:Win32/Banload.BGW
Arcabit	Trojan.Symmi.D110A0
ZoneAlarm	Trojan-Downloader.Win32.Delf.kloh
GData	Gen:Variant.Symmi.69792
Cynet	Malicious (score: 85)
AhnLab-V3	Downloader/Win32.Delf.C1727908
McAfee	Trojan-FKXW!617B473E44B3
MAX	malware (ai score=81)
VBA32	BScope.TrojanBanker.ChePro
Malwarebytes	Malware.AI.4206996100
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/TrojanDownloader.Banload.XTI
TrendMicro-HouseCall	TROJ_BANLOAD.YWNST
Tencent	Win32.Trojan-downloader.Delf.Wmsx
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	W32/Banload.XTF!tr
BitDefenderTheta	AI:Packer.08542BAE21
AVG	Win32:Banker-MYS [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Win32/Trojan.bce