Categories: SpyTrojan

About “TrojanSpy:Win32/Bancos.AHX” infection

The TrojanSpy:Win32/Bancos.AHX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanSpy:Win32/Bancos.AHX virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Enumerates running processes
Expresses interest in specific running processes
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Portuguese (Brazilian)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Code injection with CreateRemoteThread in a remote process
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Installs itself for autorun at Windows startup
Anomalous binary characteristics

How to determine TrojanSpy:Win32/Bancos.AHX?


File Info:
name: A0DACF6B498C5B0A8345.mlwpath: /opt/CAPEv2/storage/binaries/8c6d765b0624557b3c45530aa492e433ed0e0b0fc76744c49979d3d4fd3f9927crc32: 6606FCE0md5: a0dacf6b498c5b0a8345e22bc0179f0esha1: d4b92f7046afcc663a9d9e8fb7005a938031ed56sha256: 8c6d765b0624557b3c45530aa492e433ed0e0b0fc76744c49979d3d4fd3f9927sha512: 93352e35adc804cc1d2fe6f192e29b35002bc8ee3062e20409eb0f3fb6f2e1f1c709487046f52f92421053b3c12a7e1e7e7beba7dc4f9943e78486cea55aebf9ssdeep: 12288:S5vQJlHb8/J9ZnKJxUIU95+jnDhuLAzZueHf8WAsMz/pQxKLbdQlQbk9qw+oBR7P:StKlHkZnMlU6hkoUfTBuKLby99NH7type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T15C458D26A2911632C4E22D3ECC1B73A84C7EFD502D34958B27F93C58BE756613939E87sha3_384: 10858417410fe00983bc787694c62d868dc5653f845414fba37fa17b7bcb99c630f43b02848a5f797f8461aa6aca35b9ep_bytes: 558bec83c4e85333c08945ec8945e8b8timestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

TrojanSpy:Win32/Bancos.AHX also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Pincav.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.66
FireEye	Generic.mg.a0dacf6b498c5b0a
McAfee	Artemis!A0DACF6B498C
Cylance	Unsafe
Zillya	Trojan.Pincav.Win32.15156
Sangfor	Spyware.Win32.Bancos.AHX
BitDefender	Gen:Variant.Barys.66
Cybereason	malicious.b498c5
BitDefenderTheta	Gen:NN.ZelphiF.34294.jHW@a02@CngG
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.Banker.WDW
TrendMicro-HouseCall	Mal_Banker15
Paloalto	generic.ml
Kaspersky	not-a-virus:HEUR:AdWare.Win32.Generic
Alibaba	TrojanSpy:Win32/Bancos.8823cc0b
NANO-Antivirus	Trojan.Win32.Pincav.diqsb
Tencent	Trojan.Win32.BitCoinMiner.la
Ad-Aware	Gen:Variant.Barys.66
Sophos	Mal/Banker-AG
Comodo	Suspicious@#8vmxb3fzk94u
DrWeb	Trojan.Inject.49609
VIPRE	Trojan.Win32.Generic.pak!cobra
TrendMicro	Mal_Banker15
McAfee-GW-Edition	Artemis!Trojan
SentinelOne	Static AI – Malicious PE
Emsisoft	Gen:Variant.Barys.66 (B)
APEX	Malicious
Jiangmin	Trojan/Pincav.nek
Avira	TR/Spy.Banker.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASMalwS.2F1722
Microsoft	TrojanSpy:Win32/Bancos.AHX
Arcabit	Trojan.Barys.66
SUPERAntiSpyware	Trojan.Agent/Gen-Banker
GData	Gen:Variant.Barys.66
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Inject.R6899
ALYac	Gen:Variant.Barys.66
TACHYON	Trojan/W32.DP-Pincav.1196544
VBA32	Malware-Cryptor.Inject.gen
Malwarebytes	Malware.AI.3723146080
Panda	Generic Malware
Yandex	Trojan.Pincav!QyvQ8wdJ+Fg
Ikarus	Packed.Win32.Katusha
eGambit	Generic.Malware
Fortinet	W32/Banker.BKU!tr
Webroot	W32.Malware.Gen
AVG	Win32:Banker-IEN [Spy]
Avast	Win32:Banker-IEN [Spy]
CrowdStrike	win/malicious_confidence_100% (W)