Categories: Spy

Win32/Spy.Bancos.U (file analysis)

The Win32/Spy.Bancos.U is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Spy.Bancos.U virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Win32/Spy.Bancos.U?


File Info:
crc32: 6CDC86B9md5: f6003af20a36a3927b887be1b19718dbname: F6003AF20A36A3927B887BE1B19718DB.mlwsha1: cafb14acf4befd8fb30a57e2e75f05195dae39d4sha256: 5700197aaf714af42f617ff60fcfd1ba75afc8db9a791b90430e322227fafb04sha512: 20d26c2d04c8f14fc42e319252d89ffc74d38ef1519edb1787549967d2ad44eccfbcac5f3248658a6d1df0b9eaaa37bec2bcb9d894efd1cdd4afb3ed2f6954aessdeep: 3072:hw70fqStUU2dc2O7kpTa7p3KXQQH4FNdo8cxa3XQV0GX:zfRucypTqp6AQUro8cxa3gV0itype: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Version Info:
Translation: 0x0409 0x04b0LegalCopyright: Microsoft CorporationInternalName: kernelsNTFileVersion: 3.00CompanyName: Microsoft CorporationLegalTrademarks: Microsoft CorporationComments: kernelNTProductName: kernelNTProductVersion: 3.00FileDescription: kernelNT.exeOriginalFilename: kernelsNT.exe

Win32/Spy.Bancos.U also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 005376ae1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Bancos.207
Cynet	Malicious (score: 100)
CMC	Generic.Win32.f6003af20a!MD
ALYac	Dropped:Trojan.Banker.VB.AB
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_70% (D)
Alibaba	TrojanSpy:Win32/Bancos.9e7ea8a7
K7GW	Trojan ( 005376ae1 )
Cybereason	malicious.20a36a
Baidu	Win32.Trojan.Bancos.a
Cyren	W32/Bancos.YKBI-3430
Symantec	Infostealer.Bancos
ESET-NOD32	Win32/Spy.Bancos.U
APEX	Malicious
Avast	FileRepMalware
ClamAV	Win.Spyware.Banker-206
Kaspersky	Trojan-Banker.Win32.Bancos.ha
BitDefender	Dropped:Trojan.Banker.VB.AB
NANO-Antivirus	Trojan.Win32.Banker.eprp
ViRobot	Trojan.Win32.S.Bancos.123904.B
MicroWorld-eScan	Dropped:Trojan.Banker.VB.AB
Tencent	Malware.Win32.Gencirc.10b5475f
Ad-Aware	Dropped:Trojan.Banker.VB.AB
Sophos	ML/PE-A + Troj/Bancos-RO
Comodo	TrojWare.Win32.Spy.Bancos.U@3wc3
BitDefenderTheta	Gen:NN.ZevbaF.34770.hi0faeujJCni
VIPRE	Trojan-Spy.Win32.Bancos.ha (v)
TrendMicro	TSPY_BANCOS.ARL
McAfee-GW-Edition	BehavesLike.Win32.VirRansom.cc
FireEye	Generic.mg.f6003af20a36a392
Emsisoft	Dropped:Trojan.Banker.VB.AB (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	TrojanSpy.Bancos.bzx
Webroot	W32.InfoStealer.Bancos
Avira	TR/Spy.Bancos.PQ
Antiy-AVL	Trojan/Generic.ASMalwS.DABF7
Microsoft	TrojanSpy:Win32/Bancos
Arcabit	Trojan.Banker.VB.AB
AegisLab	Trojan.Win32.Bancos.l3Qv
ZoneAlarm	Trojan-Banker.Win32.Bancos.ha
GData	Dropped:Trojan.Banker.VB.AB
Acronis	suspicious
McAfee	PWS-Banker.gen.h
MAX	malware (ai score=100)
VBA32	SIM.Trojan.VBO.0577
Malwarebytes	Malware.AI.3489154154
Panda	Trj/Banker.ANL
TrendMicro-HouseCall	TSPY_BANCOS.ARL
Rising	Spyware.Bancos!1.98E3 (CLASSIC)
Yandex	Trojan.Banker!GxKj8vvA/48
Ikarus	Trojan-Spy.Win32.Bancos.ha
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Bancos.HA!tr
AVG	FileRepMalware
Paloalto	generic.ml
Qihoo-360	Win32/TrojanPSW.Bancos.HxEAEpsA