Trojan

TrojanDownloader:Win32/VB.YAN (file analysis)

Malware Removal

The TrojanDownloader:Win32/VB.YAN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What TrojanDownloader:Win32/VB.YAN virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • HTTPS urls from behavior.
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Authenticode signature is invalid
  • Attempts to modify proxy settings
  • Harvests cookies for information gathering
  • Anomalous binary characteristics
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanDownloader:Win32/VB.YAN?



File Info:

name: 7225C99779E7AEE7EC01.mlw
path: /opt/CAPEv2/storage/binaries/bdc1ecb7d7f607b4367e7ca8d4a83747e0091cfb2f3691cc9f03e3fdde126b49
crc32: B42A882B
md5: 7225c99779e7aee7ec011cd102e64490
sha1: 956cfa296dbf76517b3e19b44ee471a3b8b7bc18
sha256: bdc1ecb7d7f607b4367e7ca8d4a83747e0091cfb2f3691cc9f03e3fdde126b49
sha512: e081c8c1205eb23200374d1a59b0ec90ce6fd80c6eea521f2dd030b661bcba9f51e9ddddc4059f57462f3ae7f8bb7e6785aeb6ad03de319f3f566cec1dd0ef9d
ssdeep: 384:nN2qmH/zQBsI7F2OVWXIQjGMDKHs2Kuq2uK:n8ffIR2OwXIyh7H0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14BB26462B76C9032F25986B30D7282E91576BD310A509E5B398EBF2C1E3574279F470F
sha3_384: 04723c63fb239d171f26281c5f3edf7fdc642b6749f3fc3fa253bcb3a416bd3ed40ed61d1076ee424262bcb7e8942af3
ep_bytes: 68b8164000e8eeffffff000000000000
timestamp: 2011-03-21 03:18:19


Version Info:

Translation: 0x0804 0x04b0
CompanyName: 微软中国
ProductName: 第一下载包
FileVersion: 1.00
ProductVersion: 1.00
InternalName: baidu
OriginalFilename: baidu.exe

TrojanDownloader:Win32/VB.YAN also known as:

LionicTrojan.Win32.Genome.tnQo
DrWebTrojan.DownLoader2.44017
MicroWorld-eScanGen:Variant.Midie.58460
FireEyeGeneric.mg.7225c99779e7aee7
CAT-QuickHealTrojanDownloader.VB.YAN3
ALYacGen:Variant.Midie.58460
MalwarebytesMalware.AI.2642819679
ZillyaDownloader.Genome.Win32.27060
SangforSuspicious.Win32.Save.vb
K7AntiVirusTrojan-Downloader ( 0023d7621 )
AlibabaTrojanDownloader:Win32/Genome.a075a5f3
K7GWTrojan-Downloader ( 0023d7621 )
Cybereasonmalicious.779e7a
BitDefenderThetaGen:NN.ZevbaF.36250.bm0@au8DBonb
VirITTrojan.Win32.VB.LIQ
CyrenW32/VB.JTBM-2068
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/TrojanDownloader.VB.PBG
APEXMalicious
ClamAVWin.Trojan.Genome-10896
KasperskyTrojan-Downloader.Win32.Genome.cgrj
BitDefenderGen:Variant.Midie.58460
NANO-AntivirusTrojan.Win32.TrjGen.covkjy
ViRobotTrojan.Win32.A.Downloader.24576.N
AvastWin32:Trojan-gen
TencentMalware.Win32.Gencirc.10b2beb0
EmsisoftGen:Variant.Midie.58460 (B)
F-SecureTrojan.TR/VB.Downloader.Gen
BaiduWin32.Trojan-Downloader.VB.o
VIPREGen:Variant.Midie.58460
TrendMicroTROJ_DLVB.SMIE
McAfee-GW-EditionBehavesLike.Win32.Infected.mz
SophosMal/Emogen-F
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Midie.58460
JiangminTrojanDownloader.Genome.abjr
WebrootW32.Trojan.Downloader
GoogleDetected
AviraTR/VB.Downloader.Gen
MAXmalware (ai score=100)
Antiy-AVLTrojan[Downloader]/Win32.Genome
XcitiumTrojWare.Win32.Downloader.Generic.gt@4odcv5
ArcabitTrojan.Midie.DE45C
SUPERAntiSpywareTrojan.Agent/Gen-Downloader
ZoneAlarmTrojan-Downloader.Win32.Genome.cgrj
MicrosoftTrojanDownloader:Win32/VB.YAN
CynetMalicious (score: 100)
AhnLab-V3Downloader/Win32.VB.R3978
McAfeeArtemis!7225C99779E7
VBA32Trojan.VB.01101
Cylanceunsafe
PandaGeneric Malware
TrendMicro-HouseCallTROJ_DLVB.SMIE
RisingDownloader.VBEx!1.9A01 (CLASSIC)
YandexTrojan.GenAsa!6ofzVseykGc
IkarusTrojan-Downloader.VB
FortinetW32/Genome.VB!tr.dldr
AVGWin32:Trojan-gen
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove TrojanDownloader:Win32/VB.YAN?

TrojanDownloader:Win32/VB.YAN removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment