TrojanSpy:Win32/Banker.ES removal tips

The TrojanSpy:Win32/Banker.ES is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanSpy:Win32/Banker.ES virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine TrojanSpy:Win32/Banker.ES?


File Info:
crc32: 821CBBAC
md5: 5e4669560d4a8984782268262b9f13fb
name: 5E4669560D4A8984782268262B9F13FB.mlw
sha1: 2538744a9cd4b08d3003c62d1a3aef448ba01731
sha256: b9d691fcea7be2937ebadd157e7b5fcfd8e176f4ec3900cade4ca20e23224cf0
sha512: 6f165963762c38926192c002f597675efb1fe7bde4433409ab051cff9280cef25918654fd974e64b5f43a03befc929c8e36ceb828149653c0c917626f803bc2e
ssdeep: 3072:u+iNkhwCEJvPHFUMc+X2AeBRU0GwESMkNn0Kt/R7G+:liNko2p+X2Ahvex5t/R7f
type: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed

Version Info:
Translation: 0x0409 0x04b0
LegalCopyright: Microsoft Corporation
InternalName: kernelsNT
FileVersion: 3.00
CompanyName: Microsoft Corporation
LegalTrademarks: Microsoft Corporation
Comments: kernelNT
ProductName: kernelNT
ProductVersion: 3.00
FileDescription: kernelNT.exe
OriginalFilename: kernelsNT.exe

TrojanSpy:Win32/Banker.ES also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 005376ae1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Bancos.207
Cynet	Malicious (score: 100)
ALYac	DeepScan:Generic.Malware.SMg9.3169C428
Cylance	Unsafe
Zillya	Trojan.Bancos.Win32.14130
CrowdStrike	win/malicious_confidence_80% (D)
K7GW	Trojan ( 005376ae1 )
Cybereason	malicious.60d4a8
Baidu	Win32.Trojan.Bancos.a
Cyren	W32/Bancos.BCZX-2253
Symantec	Infostealer.Bancos
ESET-NOD32	Win32/Spy.Bancos.NCD
APEX	Malicious
Avast	Win32:Bancos-IC [Trj]
ClamAV	Win.Spyware.Banker-201
Kaspersky	Trojan-Banker.Win32.Bancos.ha
BitDefender	DeepScan:Generic.Malware.SMg9.3169C428
NANO-Antivirus	Trojan.Win32.Banker.eprp
MicroWorld-eScan	DeepScan:Generic.Malware.SMg9.3169C428
Tencent	Malware.Win32.Gencirc.10b5475f
Ad-Aware	DeepScan:Generic.Malware.SMg9.3169C428
Sophos	Mal/Generic-R + Troj/Bancos-RO
Comodo	TrojWare.Win32.TrojanSpy.Banker.~QB@2mwkm
BitDefenderTheta	Gen:NN.ZevbaF.34796.hi0faqK0U7ni
VIPRE	Trojan-Spy.Win32.Bancos.ha (v)
TrendMicro	TSPY_BANCOS.AWJ
McAfee-GW-Edition	BehavesLike.Win32.VirRansom.cc
FireEye	Generic.mg.5e4669560d4a8984
Emsisoft	DeepScan:Generic.Malware.SMg9.3169C428 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanSpy.Bancos.bse
Avira	TR/Spy.Bancos.PQ
Microsoft	TrojanSpy:Win32/Banker.ES
GData	DeepScan:Generic.Malware.SMg9.3169C428
AhnLab-V3	Trojan/Win32.Bancos.R148139
Acronis	suspicious
McAfee	PWS-Banker.gen.i
MAX	malware (ai score=89)
VBA32	SIM.Trojan.VBO.0577
Malwarebytes	Malware.AI.1509220109
Panda	Trj/Banbra.BDQ
TrendMicro-HouseCall	TSPY_BANCOS.AWJ
Rising	Spyware.Bancos!1.98E3 (CLASSIC)
Yandex	Trojan.PWS.Bancos!xgVFSTz6Rlw
Ikarus	Trojan-Spy.Win32.Bancos.ha
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Bancos.HA!tr
AVG	Win32:Bancos-IC [Trj]
Paloalto	generic.ml
Qihoo-360	Win32/TrojanPSW.Bancos.HxEAEpsA

How to remove TrojanSpy:Win32/Banker.ES?

TrojanSpy:Win32/Banker.ES removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X