Categories: Trojan

Trojan:Win32/Swisyn.GNF!MTB removal

The Trojan:Win32/Swisyn.GNF!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Swisyn.GNF!MTB virus can do?

Sample contains Overlay data
Uses Windows utilities for basic functionality
CAPE extracted potentially suspicious content
Executed a command line with /V argument which modifies variable behaviour and whitespace allowing for increased obfuscation options
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
A scripting utility was executed

How to determine Trojan:Win32/Swisyn.GNF!MTB?


File Info:
name: 5E484FF0633E876D70FD.mlwpath: /opt/CAPEv2/storage/binaries/4b3a80d862d1d1addb0f618bb2e2658ac2059e18c226bb45750d1c24e74ee236crc32: 25AB15B6md5: 5e484ff0633e876d70fd042e677ccfbasha1: 0f49734f53b00bc19b4aecb5b77b8119ac83ac68sha256: 4b3a80d862d1d1addb0f618bb2e2658ac2059e18c226bb45750d1c24e74ee236sha512: 4e665b99c6be20bf08b4716a198721cbf84657c5e595265525f02633d0e5f683bc1ef32d86cd3cc70bf82fc93b2d012d2e931c78416a244d39f947c5ae940364ssdeep: 1536:EGqRGbQHSgOTw1BFxnsUdsdBhMgxRFy2kckEUEVvccRPAAXLSYPph/ATvYSByU6F:lbjgjXxdWBhMwRFy2Rk/kcIAebPph/AGtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T16EA3CF19EA02C9B2C1320B7DD54A4EF5E5F67E3274D9423336F17ECBAD642E2405A932sha3_384: 5d78d6c45affa77df4f9b8f61cc8643da9d0b71a0d9f5f5d2fce99d232f36328ef2f17bbc43f0ef6edfd41b59cbc2501ep_bytes: 558bec83c4f0b87457ee7ee8ece7fffftimestamp: 1992-06-19 22:22:17
Version Info:
0: [No Data]

Trojan:Win32/Swisyn.GNF!MTB also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Symmi.79567
Skyhigh	BehavesLike.Win32.Dropper.nc
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Symmi.79567
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 7000000f1 )
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.f53b00
Arcabit	Trojan.Symmi.D136CF
VirIT	Backdoor.Win32.Hupigon5.BBZP
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.ACMZ
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Agent-855332
Kaspersky	Trojan-Dropper.Win32.Injector.pesl
BitDefender	Gen:Variant.Symmi.79567
NANO-Antivirus	Trojan.Win32.Hupigon.ejwgdp
Avast	Win32:Agent-AXJS [Trj]
Tencent	Malware.Win32.Gencirc.10bf4538
Emsisoft	Gen:Variant.Symmi.79567 (B)
F-Secure	Backdoor.BDS/Hupigon.Gen
DrWeb	Trojan.Siggen6.13898
Zillya	Trojan.Swisyn.Win32.13530
TrendMicro	PAK_Xed-3
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.5e484ff0633e876d
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Swisyn.lcq
Varist	W32/Risk.IGTT-1663
Avira	BDS/Hupigon.Gen
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Swisyn
Kingsoft	malware.kb.b.966
Microsoft	Trojan:Win32/Swisyn.GNF!MTB
ZoneAlarm	Trojan-Dropper.Win32.Injector.pesl
GData	Gen:Variant.Symmi.79567
Google	Detected
AhnLab-V3	Trojan/Win32.Swisyn.C3787
BitDefenderTheta	AI:Packer.D879DB4320
ALYac	Gen:Variant.Symmi.79567
VBA32	TrojanDropper.Injector
Cylance	unsafe
TrendMicro-HouseCall	PAK_Xed-3
Rising	Trojan.Swisyn!8.630 (TFE:5:qLEQugSxqWS)
Yandex	Backdoor.Hupigon!AjaH7+Dq3AI
Ikarus	Trojan-Spy.Win32.Dibik
MaxSecure	Trojan.Malware.220048527.susgen
Fortinet	W32/Injector.fam!tr
AVG	Win32:Agent-AXJS [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)