Trojan.Agent.BNAA removal instruction

The Trojan.Agent.BNAA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Agent.BNAA virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the KeyBase malware family
• Attempts to interact with an Alternate Data Stream (ADS)
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.Agent.BNAA?

File Info:
name: EA61906AF11C01598D12.mlw
path: /opt/CAPEv2/storage/binaries/814105ff0b9278f167796cbaa9960d1376e02585a79c9858578af70ec45244e9
crc32: 347FD63A
md5: ea61906af11c01598d123f1061cda70e
sha1: 30f355fbaed0eda591840b2996890bba4b9e8544
sha256: 814105ff0b9278f167796cbaa9960d1376e02585a79c9858578af70ec45244e9
sha512: a09abaf65a7c516767a7b7919aec049ca06b0c41b1f594871b533548928c2a0b343e934e71b64be82ccd28591b64d25c3d1b5516e3562205cab905a90d52781e
ssdeep: 49152:jbCjPKNqQIFIbBMy+bCjPKNqQIFIbBMyv:XCjPKNv/qCjPKNv/v
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A516D0C6F2EA40E6DC023FF5582467C79B344736473840597BAB3D498F234A9C16ABB6
sha3_384: 9cb8d7bd26e8d101f4574d5f3f4fc412f88fcbc612109553227b96a1cc4e695e10f84e3c57c183479fc4ee791a8af208
ep_bytes: e837c20000e979feffffcccccccccccc
timestamp: 2010-01-15 16:09:54

Version Info:
CompanyName: CHENGDU YIWO Tech Development Co., Ltd
FileDescription: EaseUS Data Recovery Wizard
FileVersion: 9.0.0
InternalName: Data Recovery Wizard
LegalCopyright: Copyright (c) 2004-2015 EaseUS.ALL RIGHTS RESERVED.
OriginalFilename: EaseUS Data Recovery Wizard
ProductName: EaseUS Data Recovery Wizard
ProductVersion: 9.0.0
Translation: 0x0804 0x04b0

Trojan.Agent.BNAA also known as:

How to remove Trojan.Agent.BNAA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.