Trojan:Win32/Hancitor.GC!MTB (file analysis)

The Trojan:Win32/Hancitor.GC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Hancitor.GC!MTB virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan:Win32/Hancitor.GC!MTB?


File Info:
crc32: 20960482
md5: 9bd66145920400bb82836e07be214b86
name: 9BD66145920400BB82836E07BE214B86.mlw
sha1: 08e736669230b76141a1442b8ecb2868590c5333
sha256: 7f410143b514be9140b2eed5e99b6efecebade210a8ba0d4111faf0c880b949c
sha512: 1787856175b703f0db5d6b4382132d86eceeb9be9b1e2281098b5531f60784b9819f402ff95cb8891a14ca223409b5eee103e09e639b717585c0f6c256a4ed49
ssdeep: 6144:NoDXt02LN4DpFJZ2aCfTphY+2ou9ZryjYC0roo:CXtnLNuFJZ0nVwysbV
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: bcdedit.exe
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.1.7601.17514
FileDescription: Boot Configuration Data Editor
OriginalFilename: bcdedit.exe
Translation: 0x0409 0x04b0

Trojan:Win32/Hancitor.GC!MTB also known as:

Bkav	W32.AIDetectGBM.malware.01
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.45134813
McAfee	Drixed-FJZ!9BD661459204
Malwarebytes	Trojan.Dridex
Zillya	Trojan.Qshell.Win32.15
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.45134813
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Generic.D2B0B3DD
ESET-NOD32	a variant of Win32/Kryptik.HIGI
APEX	Malicious
Ad-Aware	Trojan.GenericKD.45134813
Sophos	Mal/Generic-R + Mal/EncPk-APV
DrWeb	Trojan.Dridex.735
TrendMicro	TrojanSpy.Win32.DRIDEX.SMTH.hp
McAfee-GW-Edition	BehavesLike.Win32.Generic.gh
FireEye	Generic.mg.9bd66145920400bb
Emsisoft	Trojan.Crypt (A)
Ikarus	Trojan.Win32.Dridex
Jiangmin	Trojan.Qshell.ad
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Gridinsoft	Trojan.Win32.Kryptik.oa!s1
Microsoft	Trojan:Win32/Hancitor.GC!MTB
AhnLab-V3	Malware/Win32.Generic.C4291878
GData	Trojan.GenericKD.45134813
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.45134813
MAX	malware (ai score=84)
VBA32	BScope.Trojan.Qshell
Panda	Generic Malware
TrendMicro-HouseCall	TrojanSpy.Win32.DRIDEX.SMTH.hp
Rising	Trojan.Kryptik!1.D006 (CLASSIC)
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	W32/Kryptik.HIZF!tr
MaxSecure	Trojan.Malware.111457101.susgen

How to remove Trojan:Win32/Hancitor.GC!MTB?

Trojan:Win32/Hancitor.GC!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Hancitor.GC!MTB (file analysis)