About “Trojan.Downloader.JPAN” infection

The Trojan.Downloader.JPAN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Downloader.JPAN virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.Downloader.JPAN?

File Info:
name: B7221AC5AE0683FAA981.mlw
path: /opt/CAPEv2/storage/binaries/373efdffda6c17c803cba64a17f13d6e9cd12bdc95d71d1f02c5c757b17d0a13
crc32: 0DC2C23C
md5: b7221ac5ae0683faa981049518fa82d3
sha1: 09e2703cc7ad80bd0fc846b2cd6dc25cbbff39c4
sha256: 373efdffda6c17c803cba64a17f13d6e9cd12bdc95d71d1f02c5c757b17d0a13
sha512: 10359503fe396f9fba7da99d4d862f6a38bf93f857588b75a3c9557a99621ca5d2e325d4972b01ed0b2715aea2f8e0ba27484f0f92468e2f4c41179e743bbed1
ssdeep: 3072:hLO3n0qFEj+5aQNAKllzZP3XUjolCiQVqZjhnIf5O+xkqC1S3HVoD4VkHAvrulr:an0nwZMclCiQVqZjhnIf5O+xkqC1mHVs
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E704D57DB390973EE416E2F6696A8398106D6E3A28D1E417F7C22B08B5F09E3D131353
sha3_384: 6465eee0685b0be114deb594275c98c56ccd75e8ad0c3d75ac738c703f3eb9137482f3e6cf184d726a3104acaea16d99
ep_bytes: 6874394000e8f0ffffff000000000000
timestamp: 2012-01-25 19:13:30

Version Info:
Translation: 0x0409 0x04b0
ProductName: HMhcgcebB
FileVersion: 1.00
ProductVersion: 1.00
InternalName: vdfKSXbt
OriginalFilename: vdfKSXbt.exe

Trojan.Downloader.JPAN also known as:

How to remove Trojan.Downloader.JPAN?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.