Win32/Spy.Danabot.U removal

The Win32/Spy.Danabot.U is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.Danabot.U virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/Spy.Danabot.U?


File Info:
name: 137215315EBF1A920F6C.mlw
path: /opt/CAPEv2/storage/binaries/7417ee2722871b2c667174acc43dd3e79fcdd41bef9a48209eeae0ed43179e1f
crc32: 2155E1B1
md5: 137215315ebf1a920f6ca96be486e358
sha1: 415f9b8794e7a275df66a0bda548b83d22a8636e
sha256: 7417ee2722871b2c667174acc43dd3e79fcdd41bef9a48209eeae0ed43179e1f
sha512: 217a084c5bef4e9656528490b30337f3261f3c84ed3845e80600ee14e154c0912778db49a7412598def09d69ec9d81000a403b223be6d95f450caa6b3dcb6b47
ssdeep: 24576:ovJy1cqPkeu+kfgqu4ebFUBvawaWDIXDmOgMAbjhlPdvvFGuVP5iEzM4zT0pjss1:oxBHpa3WDv3hpdvv8uJMQBTA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14D954C32F244A63AD07B2EB55833A5186A3F767179268C9F57E4484CCF396402B3E74B
sha3_384: dbe14503d85c665ef5e91020066ed49ddb0a87a500282883d638a9ec1c6384f5cfe6299b744b3a465df7b7b14adc5b29
ep_bytes: 558bec83c4f0b8f0e65800e86092e7ff
timestamp: 2023-09-12 13:45:18

Version Info:
0: [No Data]

Win32/Spy.Danabot.U also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.390454
Malwarebytes	MachineLearning/Anomalous.97%
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 005706321 )
K7GW	Trojan-Downloader ( 005706321 )
Cybereason	malicious.794e7a
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.Danabot.U
APEX	Malicious
BitDefender	Gen:Variant.Barys.390454
Emsisoft	Gen:Variant.Barys.390454 (B)
VIPRE	Gen:Variant.Barys.390454
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
FireEye	Generic.mg.137215315ebf1a92
GData	Gen:Variant.Barys.390454
MAX	malware (ai score=84)
Arcabit	Trojan.Barys.D5F536
BitDefenderTheta	Gen:NN.ZelphiF.36662.3TW@aGjfNLf
ALYac	Gen:Variant.Barys.390454
Cylance	unsafe
Rising	Trojan.Generic@AI.100 (RDML:OjbbX4sFCtDyZnTitflPLQ)
MaxSecure	Trojan.Malware.300983.susgen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Win32/Spy.Danabot.U?

Win32/Spy.Danabot.U removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X