Categories: Spy

Win32/Spy.Banker.AENO malicious file

The Win32/Spy.Banker.AENO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Spy.Banker.AENO virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Performs HTTP requests potentially not found in PCAP.
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests cookies for information gathering
Installs WinPCAP

How to determine Win32/Spy.Banker.AENO?


File Info:
name: 35BBA6D8574D1211E260.mlwpath: /opt/CAPEv2/storage/binaries/42e60ce9f0b7c5260282a7006af0166cd3603a6043d833719586bd1adaece138crc32: 3006928Cmd5: 35bba6d8574d1211e260e5fc014c2b54sha1: 9a27335b6bb3df1045f132acfbb6edda8241ce9esha256: 42e60ce9f0b7c5260282a7006af0166cd3603a6043d833719586bd1adaece138sha512: 14ce768b945f8d2cc3ece8b0dcd06ac7abf962a0075c06c04cd56881c28ee284b54d8050459672234ca6c3bca7a83eb72db3966456b6fc32dd700ac5aeb0d5a1ssdeep: 12288:eYV6MorX7qzuC3QHO9FQVHPF51jgcHS0oigm:9BXu9HGaVH7type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1BA8412C02ED6DD7AC0A523BAC43ADC50A8257871CAD83B5D8799F21EB836383D41765Fsha3_384: 89dc742f15a538bb0f76de59cc59f824f2aa4e268335179f1ea3298c6937d3e208e07de94c9ba2a8d2927e07d7411588ep_bytes: 60be00e048008dbe0030f7ff57eb0b90timestamp: 2021-01-30 12:26:10
Version Info:
FileVersion: 3.3.14.5Comments: http://www.autoitscript.com/autoit3/FileDescription: Aut2ExeProductVersion: 3.3.14.5LegalCopyright: ©1999-2018 Jonathan Bennett & AutoIt TeamTranslation: 0x0409 0x04b0

Win32/Spy.Banker.AENO also known as:

Bkav	W32.AIDetect.malware2
Lionic	Heuristic.File.Generic.00×1!p
ClamAV	Win.Packed.Autoit-9817465-0
FireEye	Generic.mg.35bba6d8574d1211
McAfee	RDN/Generic.dx
Malwarebytes	Malware.Heuristic.1003
VIPRE	Trojan.GenericKD.36278764
Sangfor	Spyware.Win32.Banker.AENO
BitDefender	Trojan.GenericKD.36278764
Cybereason	malicious.8574d1
Cyren	W32/ABTrojan.FFBX-4520
Symantec	Trojan.Gen.MBT
Elastic	malicious (moderate confidence)
ESET-NOD32	Win32/Spy.Banker.AENO
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Script.Alien.gen
Alibaba	TrojanDownloader:Script/Alien.176ff2a0
MicroWorld-eScan	Trojan.GenericKD.36278764
Ad-Aware	Trojan.GenericKD.36278764
Sophos	Generic PUA JK (PUA)
Comodo	Malware@#mhtt22gyvj5e
F-Secure	Dropper.DR/AutoIt.Gen
Zillya	Trojan.Alien.Script.32
TrendMicro	TROJ_FRS.0NA103IK21
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.36278764 (B)
Ikarus	Dropper.AutoIt
GData	Trojan.GenericKD.36278764
Webroot	W32.Trojan.Gen
Avira	DR/AutoIt.Gen
MAX	malware (ai score=87)
Antiy-AVL	Trojan[Downloader]/Autoit.Inetget.a
Arcabit	Trojan.Generic.D22991EC
ZoneAlarm	HEUR:Trojan.Script.Alien.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Malware/Win32.Generic.C4352284
ALYac	Trojan.Dropper.Autoit
VBA32	Trojan-Downloader.Autoit.gen
Cylance	Unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_FRS.0NA103IK21
MaxSecure	Trojan.Malware.7175203.susgen
Fortinet	AutoIt/Filecoder.X!tr.ransom
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)