Spy

Win32/Spy.Banker.YRX (file analysis)

Malware Removal

The Win32/Spy.Banker.YRX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/Spy.Banker.YRX virus can do?

  • Creates RWX memory
  • Unconventionial language used in binary resources: Portuguese (Brazilian)
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Attempts to disable UAC
  • Attempts to modify UAC prompt behavior
  • Connects to an IRC server, possibly part of a botnet
  • Anomalous binary characteristics

Related domains:

pop3.uol.com.br

How to determine Win32/Spy.Banker.YRX?



File Info:

crc32: E5735352
md5: 509ff2a292ed0686b523675ee3d622e7
name: 509FF2A292ED0686B523675EE3D622E7.mlw
sha1: 18b6d2cb23eee49c017c305ae4ea835b98d053f7
sha256: e003c43fe797aa0528c7816903d1deaef3dd1c0f3e9e7bce80f734956c157002
sha512: f8706a165a6d0f03d921ff5ac7713916169d98b65914fa38c6d101811a0c24685a99f46f1b9b3ef2627d464c555cb7574d6fc31b686f6447835efb3867350072
ssdeep: 49152:em4qmmwW9sFTjSCKbXHPQrFfZ+lAiI1lAXtlrclyNcCfL:5HGFT2C8fQrdZ+Kt1lutN5cCL
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed


Version Info:

LegalCopyright: mix sistemas LTDA
InternalName: mix sistemas
FileVersion: 2.3.0.0
CompanyName: mix sistemas
LegalTrademarks: mix sistemas LTDA
Comments: Verxe7xe3o limitada
ProductName: mix sistemas soluxe7xe3o em TI
ProductVersion: 2.9.0
FileDescription: mix sistemas ltda
OriginalFilename: mix sistemas
Translation: 0x0409 0x04e4

Win32/Spy.Banker.YRX also known as:

DrWebTrojan.PWS.Banker1.27720
MicroWorld-eScanTrojan.GenericKD.40129291
FireEyeTrojan.GenericKD.40129291
McAfeeArtemis!509FF2A292ED
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
BitDefenderTrojan.GenericKD.40129291
Cybereasonmalicious.292ed0
SymantecML.Attribute.HighConfidence
TrendMicro-HouseCallTROJ_GEN.R002C0DLL20
AvastWin32:Trojan-gen
KasperskyHEUR:Trojan.Win32.Generic
NANO-AntivirusTrojan.Win32.Banload.cxlamu
AegisLabTrojan.Win32.Generic.4!c
Ad-AwareTrojan.GenericKD.40129291
EmsisoftTrojan.GenericKD.40129291 (B)
ComodoMalware@#25sjnx1tcsfz2
TrendMicroTROJ_GEN.R002C0DLL20
McAfee-GW-EditionBehavesLike.Win32.Dropper.vc
SophosMal/Generic-S
IkarusTrojan-Downloader.Win32.Banload
JiangminTrojan/Generic.aneah
WebrootW32.Downloader.Gen
Antiy-AVLTrojan/Win32.Unknown
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftTrojanDownloader:Win32/Banload.gen!N
ArcabitTrojan.Generic.D264530B
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataTrojan.GenericKD.40129291
CynetMalicious (score: 90)
VBA32suspected of Trojan.Downloader.gen.h
MAXmalware (ai score=81)
MalwarebytesMalware.Heuristic.1003
PandaTrj/CI.A
APEXMalicious
ESET-NOD32Win32/Spy.Banker.YRX
RisingMalware.Undefined!8.C (TFE:5:lRs8eJx63jG)
YandexTrojan.GenAsa!e6jFOBT9RSA
FortinetW32/Banker.YRX!tr.spy
AVGWin32:Trojan-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Win32/Trojan.Spy.b0f

How to remove Win32/Spy.Banker.YRX?

Win32/Spy.Banker.YRX removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment