Categories: Trojan

What is “Win32/TrojanDownloader.Banload.YHU”?

The Win32/TrojanDownloader.Banload.YHU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Banload.YHU virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/TrojanDownloader.Banload.YHU?


File Info:
name: B55EC9ACFD827B577795.mlwpath: /opt/CAPEv2/storage/binaries/8c1cb9293fb5c16d51116d6efd2585d38fca0f2cdd11579368ef7671b0e81d08crc32: 2F90616Fmd5: b55ec9acfd827b577795f1277b4623a6sha1: 258ef503c57f1ce2a26c92ce7932144d8e3df8b2sha256: 8c1cb9293fb5c16d51116d6efd2585d38fca0f2cdd11579368ef7671b0e81d08sha512: 4166b0e4497ecccd3f6b5e6ace1b58097469724e9c0b0ef8247d682be7179daf11046c24f0df7169e8d308bf9c0a35794de272c79370d2f285d39bd0b7e9eb02ssdeep: 49152:PJvkjDh5c0FFsueSalJXa3qk5psqvUVCTx/O:PdkjgiFR3qIpBv5type: PE32 executable (console) Intel 80386, for MS Windowstlsh: T1F8E54B53B288E13EE06B1E3A49679650A93FBF602A168C577BF0094C4F357416D2E73Bsha3_384: 87dd88004037ec24fb9cc067c408976f13f1ff7f287e6a7708fb04506bf730344031065cca3f86f5ed74bac9d766c5e6ep_bytes: 558bec83c4e453565733c08945e48945timestamp: 2018-12-19 20:36:37
Version Info:
0: [No Data]

Win32/TrojanDownloader.Banload.YHU also known as:

Lionic	Trojan.Win32.Agent.4!c
MicroWorld-eScan	Gen:Variant.Zusy.308548
FireEye	Generic.mg.b55ec9acfd827b57
ALYac	Gen:Variant.Zusy.308548
Cylance	Unsafe
Zillya	Downloader.Banload.Win32.87855
Sangfor	Trojan.Win32.Agent.gen
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDownloader:Win32/Banload.f22c79ad
K7GW	Trojan-Downloader ( 005706331 )
K7AntiVirus	Trojan-Downloader ( 005706331 )
BitDefenderTheta	AI:Packer.BEF4F43721
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Banload.YHU
APEX	Malicious
Kaspersky	HEUR:Trojan-Banker.Win32.Agent.gen
BitDefender	Gen:Variant.Zusy.308548
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan-banker.Agent.Pefu
Ad-Aware	Gen:Variant.Zusy.308548
Emsisoft	Gen:Variant.Zusy.308548 (B)
Comodo	Malware@#fah0egjr74z1
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.MALREP.THABBGAH
McAfee-GW-Edition	GenericRXHJ-LQ!B55EC9ACFD82
Sophos	Mal/Generic-S
Ikarus	Trojan.Diztakun
Avira	HEUR/AGEN.1139546
Antiy-AVL	Trojan/Generic.ASMalwS.29F5B53
Microsoft	Trojan:Win32/Occamy.C8C
Arcabit	Trojan.Zusy.D4B544
GData	Gen:Variant.Zusy.308548
AhnLab-V3	Malware/Gen.Generic.C2981979
McAfee	GenericRXHJ-LQ!B55EC9ACFD82
MAX	malware (ai score=100)
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.Banker
TrendMicro-HouseCall	Trojan.Win32.MALREP.THABBGAH
Yandex	Trojan.GenAsa!dV50Nf1zmh4
Fortinet	W32/Banload.YHU!tr.dldr
AVG	Win32:Trojan-gen
Cybereason	malicious.cfd827
Panda	Trj/GdSda.A
MaxSecure	Trojan.Malware.300983.susgen