Categories: SpyTrojan

TrojanSpy:Win32/Banker!rfn (file analysis)

The TrojanSpy:Win32/Banker!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanSpy:Win32/Banker!rfn virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Installs itself for autorun at Windows startup
Anomalous binary characteristics

Related domains:

users.qzone.qq.com

How to determine TrojanSpy:Win32/Banker!rfn?


File Info:
crc32: 3DBED008md5: 1d66fcc2ff20814c97336badc4a0f10aname: us.exesha1: 6d1984163060ec6c0641160a6b54151f4882f05esha256: 6758288b6c7f0384a5f971e83973ab95dab46ff72afebedd1a5ea7dea5063cbfsha512: 08668417a6b6b65fa30ff6490ed9c8a2fb58000de1c53ffbfaa56e6df66c26d227ffd427a6eaf10453be780c7b267b951136790c54660d23ffe1286ae6392e33ssdeep: 3072:yTzkzMMbuqrlI/4VTp2ss3yOqdmCUWFUO3f8qZbNP2tGRb575zB8Jmq8O:I2blrlI/kxkykOUKfbZZP2twV/8Jt8Otype: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Version Info:
LegalCopyright: (C) x53d1x7684x6362x4e2ax5730x65b9x56dex5bb6x5927x4f5bx6d3bx52a8x4e2ax554ax662fx7684x8985x964cx751fx5730x65b9 All Rights ReservedInternalName: FJRT9RN48CMFileVersion: 3, 0, 12, 1363ProductName: x6536x5230x8d35x597dx5730x65b9x6ed1x5761x4f53x54e6x6a21x5f0fx5224x65adx54e6x98cex683cx7684x8bf4x6cd5ProductVersion: 3, 0, 12, 1363FileDescription: x53d1x7684x6362x4e2ax5730x65b9x56dex5bb6x5927x4f5bx6d3bx52a8x4e2ax554ax662fx7684x8985x964cx751fx5730x65b9Translation: 0x0804 0x04b0

TrojanSpy:Win32/Banker!rfn also known as:

MicroWorld-eScan	Gen:Variant.Mikey.113133
ALYac	Gen:Variant.Mikey.113133
Malwarebytes	Trojan.Banker
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
BitDefender	Gen:Variant.Mikey.113133
K7GW	Spyware ( 0055e3db1 )
K7AntiVirus	Spyware ( 0055e3db1 )
Invincea	heuristic
Baidu	Win32.Trojan-Spy.Agent.ak
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.Agent.OWQ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	TrojanSpy:Win32/Qzonit.d2678bf3
NANO-Antivirus	Trojan.Win32.TrjGen.edrqio
ViRobot	Trojan.Win32.U.Agent.200192.D
Tencent	Malware.Win32.Gencirc.10bf3d6c
Ad-Aware	Gen:Variant.Mikey.113133
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Trojan.XPACK.Gen@2ho5ur
F-Secure	Trojan.TR/Downloader.Gen
DrWeb	Trojan.Siggen6.59190
MaxSecure	Trojan.Malware.7164915.susgen
Zillya	Trojan.Agent.Win32.692463
TrendMicro	TSPY_KRBANKER.SM4
Fortinet	W32/SpyAgent.OWQ!tr
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.1d66fcc2ff20814c
Emsisoft	Gen:Variant.Mikey.113133 (B)
Ikarus	Trojan.Win32.Injector
Jiangmin	Trojan.Generic.acrwk
Avira	TR/Downloader.Gen
MAX	malware (ai score=100)
Endgame	malicious (high confidence)
Arcabit	Trojan.Mikey.D1B9ED
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	TrojanSpy:Win32/Banker!rfn
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Banker.R183578
Acronis	suspicious
McAfee	GenericRXAA-AA!1D66FCC2FF20
VBA32	BScope.Trojan.KillFiles
Cylance	Unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TSPY_KRBANKER.SM4
Rising	Spyware.Agent!8.C6 (TFE:5:nKL5lFumnFS)
Yandex	Trojan.Agent!SFW5Es00ZXw
SentinelOne	DFI – Suspicious PE
eGambit	Generic.Malware
GData	Gen:Variant.Mikey.113133
BitDefenderTheta	Gen:NN.ZexaF.34128.mi0aaONOdgeb
AVG	Win32:Malware-gen
Cybereason	malicious.2ff208
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	HEUR/QVM17.0.0000.Malware.Gen