Python/Rozena.BH malicious file

The Python/Rozena.BH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Python/Rozena.BH virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Attempts to connect to a dead IP:Port (1 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Created a process from a suspicious location
• CAPE detected the PyInstaller malware family

How to determine Python/Rozena.BH?

File Info:
name: 2E66EB6CA7E23B9C65BE.mlw
path: /opt/CAPEv2/storage/binaries/a45378f3388574f1cf6fad7c97222383ce66eb7f84e3a35a88b5c6a849a5afe2
crc32: 70BEA45F
md5: 2e66eb6ca7e23b9c65be77006e7a20f0
sha1: f9d97438d0200e6a62f0a5f63271f8f84f0c9603
sha256: a45378f3388574f1cf6fad7c97222383ce66eb7f84e3a35a88b5c6a849a5afe2
sha512: d472324f316efb2996b0c7a9cde234951af216285ddd0af1910db7fb48d187417df1a2abefc31b2be8b7b80a6dd3fc09d43f95049dfdfec3a27bf837e89fbc6a
ssdeep: 49152:TB1vTRMoA6JPGSE2GlvueB2+GQ6ldfHJg3NtJ+EWsJ02+DyWVsreBFvxR2CJa4Vf:5MoA6gSho2eBaZldvkfQNsp+DyUsSBFh
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T11FC53346B484C9FBD236103505A8D531953B38352F649BE3B6DC1EC3B9E23C1E27E5AA
sha3_384: 6285ba1e27d066238de4275364dabfc5b2bdf70d3c32f2cb7337b0c6ab5cddde2504995c098f88a168b6cac2c682d50f
ep_bytes: e8e75c0000e995feffff8bff558bec81
timestamp: 2012-05-25 09:26:27

Version Info:
0: [No Data]

Python/Rozena.BH also known as:

How to remove Python/Rozena.BH?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.