Categories: Trojan

Should I remove “TrojanDownloader:Win32/Phantu!B”?

The TrojanDownloader:Win32/Phantu!B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Phantu!B virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine TrojanDownloader:Win32/Phantu!B?


File Info:
name: 1CDAE285B786689B35B1.mlwpath: /opt/CAPEv2/storage/binaries/2ba956dd08bd99265de545cb3db68c7153ce856fe44ca1d37649becb7062eb13crc32: 59CF628Dmd5: 1cdae285b786689b35b1f508b27ef903sha1: c5b69047a1be701f2303014682980fbc8a790e87sha256: 2ba956dd08bd99265de545cb3db68c7153ce856fe44ca1d37649becb7062eb13sha512: 710d0b88d88c2eb370badc2a5c643282111cf56ab893c828a12672f661d0a4dca16a5dad273ead69298bcde8d7963a172291b76adebff6694e9fcde781804484ssdeep: 12288:8EpSEIEo+qboKH1DI8iCHUiy7QmfiUtI1d3B3rUNd1hRTK6yaHhUv4rzJpV:fpSEI9DH1DI8iCHUtcQ1tI13wNddK6y4type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AAF402D1DB2A1FCEFD6809BD485E2A5A0D8D6D323D31C8F1D69B25074238F9606B291Bsha3_384: 75bf5e2609b32d9e6ccfd960a9c9d5566e86a5292aee9dd4f3f0b24cc1e00a436188f64ed8408f2f93339dc786999c52ep_bytes: 60f9e802000000e800e8000000005e2btimestamp: 2006-03-17 05:27:57
Version Info:
Translation: 0x0409 0x04b0CompanyName: System ServiceFileDescription: SysMonProductName: System Monitor ServiceFileVersion: 1.00ProductVersion: 1.00InternalName: SysMonOriginalFilename: SysMon.exe

TrojanDownloader:Win32/Phantu!B also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	GenPack:Trojan.Clicker.VB.DI
FireEye	Generic.mg.1cdae285b786689b
Skyhigh	BehavesLike.Win32.PUPXAX.bm
ALYac	GenPack:Trojan.Clicker.VB.DI
Malwarebytes	Trojan.Downloader.P2P
VIPRE	GenPack:Trojan.Clicker.VB.DI
K7AntiVirus	Trojan ( 00527adf1 )
BitDefender	GenPack:Trojan.Clicker.VB.DI
K7GW	Trojan ( 00527adf1 )
Cybereason	malicious.7a1be7
BitDefenderTheta	AI:Packer.423B0A1D1F
Symantec	Trojan.Popper
Elastic	malicious (high confidence)
APEX	Malicious
ClamAV	Win.Trojan.Clicker-1246
Kaspersky	Trojan-Clicker.Win32.VB.ij
Alibaba	TrojanDownloader:Win32/Phantu.2a8d4f72
NANO-Antivirus	Trojan.Win32.VB.uyfn
Rising	Malware.Undefined!8.C (TFE:4:FK6BIANuu0O)
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Dldr.VB.AT
DrWeb	Trojan.Popuper
Zillya	Trojan.VB.Win32.69826
Trapmine	malicious.high.ml.score
Emsisoft	GenPack:Trojan.Clicker.VB.DI (B)
Ikarus	Trojan-Clicker.Win32.VB
Jiangmin	TrojanClicker.VB.oo
Google	Detected
Avira	TR/Dldr.VB.AT
Varist	W32/Backdoor.SISW-0923
Antiy-AVL	Trojan[Clicker]/Win32.VB
Kingsoft	Win32.Troj.AdClicker.a
Microsoft	TrojanDownloader:Win32/Phantu.gen!B
Xcitium	TrojWare.Win32.TrojanDownloader.VB.AT0@1o8fwn
Arcabit	GenPack:Trojan.Clicker.VB.DI
SUPERAntiSpyware	Trojan.Downloader-SysMon
ZoneAlarm	Trojan-Clicker.Win32.VB.ij
GData	GenPack:Trojan.Clicker.VB.DI
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Xema.C65808
McAfee	Artemis!1CDAE285B786
MAX	malware (ai score=100)
DeepInstinct	MALICIOUS
VBA32	TScope.Malware-Cryptor.SB
Cylance	unsafe
Panda	Adware/ConsumerAlertSystem
Zoner	Probably Heur.ExeHeaderL
Yandex	Trojan.CL.VB!QB8weQsLvRs
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1387236.susgen
Fortinet	W32/VB.IJ!tr
AVG	Win32:Small-FT [Trj]
Avast	Win32:Small-FT [Trj]
CrowdStrike	win/malicious_confidence_100% (W)