Categories: SpyTrojan

Should I remove “TrojanSpy:Win32/Ambler!pz”?

The TrojanSpy:Win32/Ambler!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanSpy:Win32/Ambler!pz virus can do?

Unconventionial binary language: Russian
Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanSpy:Win32/Ambler!pz?


File Info:
name: 13B58EF3A9C6FACFEE62.mlwpath: /opt/CAPEv2/storage/binaries/3b22308741efb5436c5173405743475e6fc76aa202dbf4cc5199895ec9cae4f0crc32: 8DC4112Amd5: 13b58ef3a9c6facfee62f97018482a07sha1: de7a642b1f0d03a937c2064c349c98585a2c3f42sha256: 3b22308741efb5436c5173405743475e6fc76aa202dbf4cc5199895ec9cae4f0sha512: 0408b6e50f821143b223de3fe4b46775fa2e4b39ee5b50b8db9ce55cdac2000fbdeee9a0c16402927eecc8b56a5c945653e2fde9df478a78016de328e9dce7f6ssdeep: 384:wDG1dKdCipAm86wzWjtAtePDAuR5QwZH9HOT06ETRSQ1uiX+jOyWFQG8sH9Wil:wDbd4NtzWj2tIUauW762vD+jOnSM9WAtype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windowstlsh: T12EE2DF86B3D0CA81C5552B780DB198D41798FF9D9E1ECB8F325A337F2FB21903A96614sha3_384: 7b3006420e35201dfa38a6f28a516c9572a7f03485e86ea8e6a0617394a27a6c950c3467671ce0efce702829789a8abfep_bytes: 807c2408010f85c201000060be004001timestamp: 2008-08-10 21:03:01
Version Info:
Comments: CompanyName: GutmanFileDescription: ExplorerFileVersion: 1, 0, 0, 1InternalName: SonarLegalCopyright: Copyright © 2008LegalTrademarks: OriginalFilename: grPrivateBuild: ProductName: SokProductVersion: 1, 0, 0, 1SpecialBuild: Translation: 0x0419 0x04b0

TrojanSpy:Win32/Ambler!pz also known as:

Lionic	Trojan.Win32.Amber.l4ij
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Adware.Heur.bmSfN4RSZzak
FireEye	Generic.mg.13b58ef3a9c6facf
CAT-QuickHeal	Trojan.Generic.8386
Skyhigh	BehavesLike.Win32.Trojan.nc
McAfee	Artemis!13B58EF3A9C6
VIPRE	Gen:Adware.Heur.bmSfN4RSZzak
Sangfor	Spyware.Win32.Banker.PKY
Alibaba	TrojanSpy:Win32/Ambler.7fe986cb
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Adware.Heur.bmSfN4RSZzak
VirIT	Backdoor.Win32.Agent.VIP
Symantec	Downloader
ESET-NOD32	Win32/Spy.Banker.PKY
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.Win32.Amber.gen
BitDefender	Gen:Adware.Heur.bmSfN4RSZzak
NANO-Antivirus	Trojan.Win32.Agent.rbat
Avast	Win32:Adware-gen [Adw]
Tencent	Malware.Win32.Gencirc.13b8805f
Sophos	Mal/Ambler-B
F-Secure	Trojan-Spy:W32/Ambler.gen!A
DrWeb	Trojan.DownLoad.3454
Zillya	Backdoor.Agent.Win32.4657
TrendMicro	WORM_AMBLER.SMI
Emsisoft	Gen:Adware.Heur.bmSfN4RSZzak (B)
Ikarus	Trojan-Downloader.Win32.BHO
Jiangmin	Backdoor/Agent.bghi
Webroot	Worm:Win32/Ambler.A
Google	Detected
Avira	TR/BHO.Gen
Antiy-AVL	Trojan[Backdoor]/Win32.Agent
Kingsoft	Win32.Trojan.Generic.a
Xcitium	Backdoor@#2upukvulexrgo
Microsoft	TrojanSpy:Win32/Ambler!pz
ZoneAlarm	HEUR:Trojan-Spy.Win32.Amber.gen
GData	Gen:Adware.Heur.bmSfN4RSZzak
Varist	W32/Ambler.C.gen!Eldorado
AhnLab-V3	Spyware/Win32.Amber.R145085
BitDefenderTheta	Gen:NN.ZedlaF.36744.bmSfa4RSZzak
ALYac	Gen:Adware.Heur.bmSfN4RSZzak
MAX	malware (ai score=100)
VBA32	BScope.TrojanSpy.Amber
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	WORM_AMBLER.SMI
Rising	Spyware.Ambler!8.852 (TFE:5:OKZlAxBpiVF)
Yandex	Trojan.GenAsa!peawcZvPiSc
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.829849.susgen
Fortinet	W32/Ambler.A!tr
AVG	Win32:Adware-gen [Adw]
DeepInstinct	MALICIOUS