Categories: Trojan

TrojanDownloader:Win32/Tearspear removal instruction

The TrojanDownloader:Win32/Tearspear is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Tearspear virus can do?

Unconventionial language used in binary resources: Portuguese (Brazilian)
The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with ASPack
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary file triggered YARA rule
Attempts to modify proxy settings
Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDownloader:Win32/Tearspear?


File Info:
name: FBA80E2132F3BB9CCBE5.mlwpath: /opt/CAPEv2/storage/binaries/f5f530a5c7530f9ba61cefd7c81616c3e3b4e30ad61ead1220dd4e9f194bd4bacrc32: 581336D8md5: fba80e2132f3bb9ccbe53abdc7fab8dfsha1: e1ce7fdf4d2025cee5bb50ca019f434b41ac989esha256: f5f530a5c7530f9ba61cefd7c81616c3e3b4e30ad61ead1220dd4e9f194bd4basha512: ac8638226908951abc2618205d8a366c39be2f64ed7bf7ff3794cc8e597130da3ec2bef02c17f52c56a2fdeec64e0dae15d84452598f5512bdd2f4948ba1214bssdeep: 3072:5dw7PHuUrgqPNaofhDIFd+pOMjDqCLIR1txCeyWkle7KJLbbOn9b5r5zqSr:k7WV0I705XqqIR1txqpeIbE19type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17B040283A509C471C1691532DC6B3EED16B26FADC83147031A157E9FBFFA2C48C167AAsha3_384: 9d6adf1a10a5f1d1175119bb09bc141e3bc0aeb97787d4dbb6b8845a60f9351429b0ab6de83bf6a9bea0be9db95a3506ep_bytes: 60e803000000e9eb045d4555c3e80100timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

TrojanDownloader:Win32/Tearspear also known as:

Lionic	Trojan.Win32.Dadobra.4!c
MicroWorld-eScan	Trojan.GenericKD.71953172
FireEye	Generic.mg.fba80e2132f3bb9c
Skyhigh	BehavesLike.Win32.ObfuscatedPoly.cc
McAfee	GenDownloader.c
Cylance	unsafe
Zillya	Downloader.Dadobra.Win32.723
Sangfor	Downloader.Win32.Agent.V99b
K7AntiVirus	Trojan ( 7000000f1 )
Alibaba	TrojanDownloader:Win32/Banload.1496e251
K7GW	Trojan ( 7000000f1 )
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Dadobra.EB
APEX	Malicious
TrendMicro-HouseCall	DOWNLOADER_DABOBRA
ClamAV	Win.Downloader.Banload-1230
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.71953172
NANO-Antivirus	Trojan.Win32.Banload.epuo
Avast	Win32:Trojano-ZE [Trj]
Tencent	Malware.Win32.Gencirc.11bd378d
Emsisoft	Trojan.GenericKD.71953172 (B)
F-Secure	Trojan.TR/Dldr.Dadobr.DT.1
DrWeb	Trojan.DownLoader.3430
TrendMicro	DOWNLOADER_DABOBRA
Trapmine	suspicious.low.ml.score
Sophos	Mal/Behav-130
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKD.71953172
Jiangmin	TrojanDownloader.Banload.adrv
Webroot	W32.Trojan.Downloader-Dadobra
Google	Detected
Avira	TR/Dldr.Dadobr.DT.1
Varist	W32/Downloader.HMRQ-8216
Antiy-AVL	Trojan[Downloader]/Win32.Dadobra
Xcitium	TrojWare.Win32.TrojanDownloader.Delf.gen@1xqow5
ViRobot	Trojan.Win32.Delf.180224
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	TrojanDownloader:Win32/Tearspear
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Dadobra.C29935
BitDefenderTheta	Gen:NN.ZelphiF.36802.lOWbaarzlfmG
MAX	malware (ai score=100)
VBA32	TrojanDownloader.Dadobra
Malwarebytes	MachineLearning/Anomalous.96%
Panda	Trj/Nabload.ACN
Rising	Trojan.DL.Win32.Banload.auf (CLOUD)
Yandex	Trojan.GenAsa!fRSfU+Rpcpw
Ikarus	Trojan-Downloader.Win32.Banload
MaxSecure	Trojan.Malware.1377437.susgen
Fortinet	W32/Delf.BIC!tr.dldr
AVG	Win32:Trojano-ZE [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Trojan[downloader]:Win/Dadobra.EB