Trojan.Invader removal guide

Malware Removal

The Trojan.Invader is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Review

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan.Invader virus can do?

  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Executable code extraction
  • Attempts to connect to a dead IP:Port (3 unique times)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Loads a driver
  • Expresses interest in specific running processes
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Attempts to create or modify system certificates
  • Attempts to interact with an Alternate Data Stream (ADS)
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
dssp.workday360.cn
a.eastfn.com

How to determine Trojan.Invader?


File Info:

crc32: AF327D20
md5: b844d8fd2faac77effc3633240e57b81
name: union_plugin_219bee0f6b20407575f536306c6fd405_de1afttd.exe
sha1: 82fd336e0f5baab6c26f648081400dfd957993aa
sha256: a19ee9645c0140e46948222d416d36081757226aee79a3c81073e8399ce0116d
sha512: 6bb1b6a31c174686cc6bbfc2fe6a43f7bf602d3e98969bd2b92cceae9efed3bc3d07d8ca743475657c7137b9c04812246413d425cdd7015bfe033b35a9be9fe0
ssdeep: 24576:Xj+TFi3WztwW9fPISZpI+vdS+Ed6gbZxCL5er5AEfe4UlGioi+JPVQmU2oZ1Sq:XatwqICaKPEUsz6EfesioiuOmy1Sq
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Trojan.Invader also known as:

MicroWorld-eScanTrojan.GenericKD.32934231
FireEyeGeneric.mg.b844d8fd2faac77e
Qihoo-360Generic/HEUR/QVM10.2.6223.Malware.Gen
ALYacTrojan.Invader.gen
CylanceUnsafe
AegisLabTrojan.Win32.Invader.4!c
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKD.32934231
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.e0f5ba
BitDefenderThetaGen:NN.ZexaF.34082.BvW@aCJWtnlj
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Malware-gen
GDataTrojan.GenericKD.32934231
KasperskyHEUR:Trojan.Win32.Invader
AlibabaTrojanDropper:Win32/dropper.ali1003001
TencentWin32.Trojan.Generic.Pezc
Ad-AwareTrojan.GenericKD.32934231
SophosMal/Generic-S
F-SecureTrojan.TR/Dropper.Gen
McAfee-GW-EditionBehavesLike.Win32.Generic.tc
Trapminemalicious.moderate.ml.score
EmsisoftTrojan.GenericKD.32934231 (B)
AviraTR/Dropper.Gen
MAXmalware (ai score=89)
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D1F68957
ZoneAlarmHEUR:Trojan.Win32.Invader
MicrosoftTrojan:Win32/Wacatac.B!ml
Acronissuspicious
McAfeeArtemis!B844D8FD2FAA
RisingDropper.Generic!8.35E (CLOUD)
SentinelOneDFI – Malicious PE
eGambitUnsafe.AI_Score_100%
FortinetW32/Malicious_Behavior.VEX
AVGWin32:Malware-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_90% (W)
MaxSecureTrojan.Malware.300983.susgen

How to remove Trojan.Invader?

Trojan.Invader removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment