Categories: Trojan

What is “Trojan.Appora”?

The Trojan.Appora is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Appora virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Enumerates the modules from a process (may be used to locate base addresses in process injection)
Enumerates running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Spoofs its process name and/or associated pathname to appear as a legitimate process

How to determine Trojan.Appora?


File Info:
name: 8AAED550B0E0607B1484.mlwpath: /opt/CAPEv2/storage/binaries/7fe1139fc2ef3a16296e2756d71f5f2872916f0fbf627c4580e4791e2b67731dcrc32: 7A58C4F5md5: 8aaed550b0e0607b148413ada8768723sha1: 3934914b2841c254b687211f2c6a1563ef710b3esha256: 7fe1139fc2ef3a16296e2756d71f5f2872916f0fbf627c4580e4791e2b67731dsha512: 4610b154d37c67de4981b4e817c6e79d43d16c9e537790888e01187e05772b269873afb464223c960f6beb759ae3b65637ff3286f66d8679597b6322cb673705ssdeep: 3072:6H5NE794HvtekSTZPAGnGDBXVJBMy+IB2fowdxcilq7Gsm08SKzgaTFa/K/1Hifb:6H5NEuPtEZbMBld+Y2fowbrP025F0type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AA54AE0262F4C166F4F21A705DBD9AA04A6E7D307B76C4CB37802E5E6C71AD0CAB4767sha3_384: 4f9f689b9732686c90205e64d02c2a55b12cc1615272f02a9792570d2482298b8fe44e69c55c9fb05d863ecf385a3f79ep_bytes: e88c170000e989feffff8bff558bec81timestamp: 2018-03-03 08:09:34
Version Info:
0: [No Data]

Trojan.Appora also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Symmi.82492
ALYac	Gen:Variant.Symmi.82492
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005294211 )
Alibaba	Trojan:Win32/Kryptik.37a97909
K7GW	Trojan ( 005294211 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/Trojan.BYJ.gen!Eldorado
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.GDXH
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Symmi.82492
NANO-Antivirus	Trojan.Win32.Kasidet.eyordb
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Generic.Edek
Ad-Aware	Gen:Variant.Symmi.82492
Emsisoft	Gen:Variant.Symmi.82492 (B)
Comodo	Malware@#1wahhfk8dom4l
DrWeb	BackDoor.IRC.Bot.4052
Zillya	Trojan.Kryptik.Win32.1432130
McAfee-GW-Edition	Packed-UZ!8AAED550B0E0
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.8aaed550b0e0607b
Sophos	Mal/Generic-R + Mal/Lethic-L
Ikarus	Trojan.Win32.Krypt
GData	Gen:Variant.Symmi.82492
Jiangmin	Backdoor.Kasidet.nb
Avira	HEUR/AGEN.1210318
MAX	malware (ai score=94)
Arcabit	Trojan.Symmi.D1423C
Microsoft	Trojan:Win32/Skeeyah.A!rfn
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.C2420013
McAfee	Artemis!8AAED550B0E0
VBA32	Trojan.Proxy
Malwarebytes	Trojan.Appora
Rising	Trojan.Generic@AI.100 (RDMK:nSFLsDs4rkpMWXszoqwdLw)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Injector.DWNR!tr
BitDefenderTheta	Gen:NN.ZexaF.34712.sqW@aS6LZmdG
AVG	Win32:Malware-gen
Cybereason	malicious.0b0e06
Panda	Trj/GdSda.A