VHO:Trojan-PSW.Win32.Stealer.jpg (file analysis)

The VHO:Trojan-PSW.Win32.Stealer.jpg is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VHO:Trojan-PSW.Win32.Stealer.jpg virus can do?

Presents an Authenticode digital signature
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

How to determine VHO:Trojan-PSW.Win32.Stealer.jpg?


File Info:
crc32: 2E0808F9
md5: 3037ad9f4fd46dd39c2a196c20899052
name: 3037AD9F4FD46DD39C2A196C20899052.mlw
sha1: 7bf7b4ce92f983546e9d4bd60b87fd4b4c71b010
sha256: 3c3f0fa14c0c28182d6012beea36b1b416b3a5add76ff23bdb4fcc67542f1013
sha512: 72106209c5bfb05e50ea2aa3310081be787480e816d07dcbd5bd118b1bb062bb6dd864a50a43bb6136b210a72ea57fd1501e75e72a834ddaf566b5a1ac646bca
ssdeep: 12288:53eviCOMJz7bLg0EKsWmAhndfnZs8svfozjC:lcjeQsWmAhBIvfozjC
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2020
Assembly Version: 1.0.0.0
InternalName: Svc_host.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: Svc_host
ProductVersion: 1.0.0.0
FileDescription: Svc_host
OriginalFilename: Svc_host.exe

VHO:Trojan-PSW.Win32.Stealer.jpg also known as:

Elastic	malicious (high confidence)
ALYac	Gen:Variant.Razy.914220
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Gen:Variant.Razy.914220
Cybereason	malicious.e92f98
ESET-NOD32	a variant of MSIL/Spy.Agent.AES
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	VHO:Trojan-PSW.Win32.Stealer.jpg
MicroWorld-eScan	Gen:Variant.Razy.914220
Ad-Aware	Gen:Variant.Razy.914220
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	Gen:NN.ZemsilF.34110.Gy2@aWqWAac
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.3037ad9f4fd46dd3
Emsisoft	Gen:Variant.Razy.914220 (B)
SentinelOne	Static AI – Malicious PE
eGambit	Trojan.Generic
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Gridinsoft	Trojan.Heur!.01012031
GData	Win32.Trojan.PSE.1MFCAJH
AhnLab-V3	Trojan/Win.Generic.C4611711
Acronis	suspicious
McAfee	Artemis!3037AD9F4FD4
MAX	malware (ai score=80)
Malwarebytes	Spyware.PasswordStealer

How to remove VHO:Trojan-PSW.Win32.Stealer.jpg?

VHO:Trojan-PSW.Win32.Stealer.jpg removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X