Trojan:Win32/Destroyer information

The Trojan:Win32/Destroyer is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Destroyer virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Destroyer?


File Info:
name: 32EAE3A8FD4A06819466.mlw
path: /opt/CAPEv2/storage/binaries/72b4ef3058b31ac4bf12b373f1b9712c3a094b7d68e5f777ba71e9966062af17
crc32: 55964ACC
md5: 32eae3a8fd4a06819466dd07ca363c4f
sha1: 63534363ccb1b8495599fb3056e6610ece49ac11
sha256: 72b4ef3058b31ac4bf12b373f1b9712c3a094b7d68e5f777ba71e9966062af17
sha512: 33b5802fa155465f3501a8470559f0fedc1b8d70a350dcbe3d3768f82f40f97158135d639fe5121845943f2d4c801bd5cc380806e27f830456cd592647188fa1
ssdeep: 48:OEPKfdGkldRMs33dE9AeHZ4JRKdoj3MvOZcrnwovM+IG1gbsulJ4dL5rWauBEUWZ:nPIGS3Ny1547KdQZDoK3ZL4doaTb/N
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T103C1F642DFA444B2D45DCAFC555FD628977732316EBA70418DDE61EC8C1E3502F2CA02
sha3_384: eb47c7741d3664bf86d2b59be1540c104ac134fb67d9f4aac23107618b80d0eeb21fe98555d069625eee3e769b77efce
ep_bytes: 558bec83c4f053b824174000e83ffeff
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Trojan:Win32/Destroyer also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Alreay.4!c
tehtris	Generic.Malware
MicroWorld-eScan	Trojan.Banker.Alreay.A
Skyhigh	MultiDropper-JD.b
McAfee	MultiDropper-JD.b
Malwarebytes	Malware.AI.2467486250
Zillya	Trojan.Alreay.Win32.22
Sangfor	Suspicious.Win32.Save.a
Alibaba	TrojanBanker:Win32/Alreay.ee41ddd5
Cybereason	malicious.3ccb1b
Arcabit	Trojan.Banker.Alreay.A
Symantec	Trojan.Gen
Elastic	malicious (high confidence)
ESET-NOD32	Win32/KillDisk.NBG
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.Banker.Alreay.A
NANO-Antivirus	Trojan.Win32.PcClient.dxlulk
Tencent	Win32.Trojan.Banker.Lkxu
Sophos	Mal/Generic-R
DrWeb	Trojan.Siggen6.60476
VIPRE	Trojan.Banker.Alreay.A
TrendMicro	TROJ_SHUTDOWNER.DAM
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.32eae3a8fd4a0681
Emsisoft	Trojan.Banker.Alreay.A (B)
Ikarus	Backdoor.Win32.PcClient
Jiangmin	Trojan.Banker.Alreay.n
Webroot	W32.Trojan.Gen
Varist	W32/Barys.E.gen!Eldorado
Antiy-AVL	Trojan[APT]/Win32.Fin7
Kingsoft	malware.kb.a.992
Microsoft	Trojan:Win32/Destroyer
ViRobot	Trojan.Win32.Z.Pcclient.5951
ZoneAlarm	HEUR:Trojan-Banker.Win32.Alreay.gen
GData	Trojan.Banker.Alreay.A
Google	Detected
AhnLab-V3	Trojan/Win.Llac.R613558
ALYac	Trojan.Banker.Alreay.A
MAX	malware (ai score=100)
VBA32	TrojanBanker.Alreay
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_SHUTDOWNER.DAM
Rising	Trojan.KillDisk!8.C4C (TFE:4:iWL46iIpDuH)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.1383451.susgen
Fortinet	W32/Multidr.JD!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:Win32/Destroyer?

Trojan:Win32/Destroyer removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X