Malware

Should I remove “NSIS/Injector.AZR”?

Malware Removal

The NSIS/Injector.AZR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What NSIS/Injector.AZR virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • Authenticode signature is invalid

How to determine NSIS/Injector.AZR?



File Info:

name: 2405B917BEA1EAFB2655.mlw
path: /opt/CAPEv2/storage/binaries/6eacfbc7fb4a62831c74e7fac472f4378a42bc73e4ab46f0257911174d27d44b
crc32: 2C79128F
md5: 2405b917bea1eafb2655c607bd39bc34
sha1: 8268682cc1660eed3daa5738d14df224fff942fe
sha256: 6eacfbc7fb4a62831c74e7fac472f4378a42bc73e4ab46f0257911174d27d44b
sha512: 4af8904ecaf88c5d4ca7528cec63dea8dd8247fdd07deb015dae3a99b5a534c34f8904b439f221b98e25e34ab10b2d2ab036b017b95221e799784d6f08779ddb
ssdeep: 3072:x1NjcVVnLpPuEoZxBtumtVPblYgWs6Os97hvE3DxnoTZw7ixESlnUrXD+aoqEXuw:rNeZKvqdFjIJw/OVhfYYtaqS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15B943BD0B498D4DBF42E16B269A6CA2024F17D6D5AE3106E72AFF36815F2703045FE2D
sha3_384: a289ec721c20f12d41b078811fe18630fb6a4eacb12d1e6a2f49dc42159a3e25fdd52bdde8d972e9c526361778365d35
ep_bytes: 558bec81ecf40300005356576a205f33
timestamp: 2021-09-25 21:55:49


Version Info:

Comments: bedrveliges ROVER HOSTEDE
CompanyName: Papyrusen TRANSVECTION Lomentaria96 fleshliest
FileDescription: Sprightfully143 EXTRAMETROPOLITAN
FileVersion: 12.2.2
LegalCopyright: Slder unsubstantialize kameluldssoks
LegalTrademarks: SANGUISUGENT modstandskrafts TETRACARBOXYLATE
ProductName: Sayability255 DENOMINATIONALIZES panteforskrivnings
Translation: 0x0409 0x04b0

NSIS/Injector.AZR also known as:

MicroWorld-eScanTrojan.GenericKD.49281446
FireEyeTrojan.GenericKD.49281446
CylanceUnsafe
AlibabaTrojanDownloader:Win32/GuLoader.313cce83
CyrenW32/Ninjector.DB.gen!Eldorado
SymantecTrojan.Gen.MBT
Elasticmalicious (high confidence)
ESET-NOD32NSIS/Injector.AZR
Paloaltogeneric.ml
KasperskyHEUR:Trojan-Downloader.Win32.GuLoader.gen
BitDefenderTrojan.GenericKD.49281446
AvastNSIS:DropperX-gen [Drp]
TencentWin32.Trojan.Falsesign.Hnkv
Ad-AwareTrojan.GenericKD.49281446
McAfee-GW-EditionArtemis!Trojan
EmsisoftTrojan.GenericKD.49281446 (B)
IkarusWin32.SuspectCrc
GDataTrojan.GenericKD.49281446
AviraTR/AD.Nekark.fszlu
MicrosoftTrojan:Win32/Wacatac.B!ml
AhnLab-V3Trojan/Win.GuLoader.C5187432
McAfeeArtemis!2405B917BEA1
MAXmalware (ai score=87)
MaxSecureTrojan.Malware.121218.susgen
AVGNSIS:DropperX-gen [Drp]

How to remove NSIS/Injector.AZR?

NSIS/Injector.AZR removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment