Trojan.Win32.APosT.enw (file analysis)

The Trojan.Win32.APosT.enw is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.APosT.enw virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Mimics the system’s user agent string for its own requests
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• Authenticode signature is invalid
• Attempts to modify proxy settings

How to determine Trojan.Win32.APosT.enw?

File Info:
name: AC1202C28D0978DE190E.mlw
path: /opt/CAPEv2/storage/binaries/98719248bf88e2e347784b383c568de446ae0876050f399df4842bef1ae9f1b8
crc32: 044F8A85
md5: ac1202c28d0978de190e40ce1777956e
sha1: 904b383ad24a43244dd8648e9ea795ba63f8e13b
sha256: 98719248bf88e2e347784b383c568de446ae0876050f399df4842bef1ae9f1b8
sha512: b5a42fc7c2bc0e1e9376a3c5b0d71f9523e053372298c4ea8cbd92524e3cd80332c85eaee593d2b3651a4e43d151ac7e4697c11cefa38fdcb274b51738d7a2a0
ssdeep: 48:Sv6tw65TX9AlLf9lYFgYuETFZZ69VhcB3JhUqjABObASznlyzk9SRuqS5:zwmTtosgYLFZ7JhvjlH5oGix
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T116C14C8B9228857BD1A80BBF444746FC325DE2707356C759BC9F521D6E403D96C87436
sha3_384: 24a4d9271d58a651669d06aa96c59d9da57a332b63d2cf94b3d80947bf82dcdc272c7f3f3dc781b5c34f720a5a11c6f4
ep_bytes: 6a01e97201000080fd00eb2e0f4fda57
timestamp: 2018-10-14 19:14:46

Version Info:
0: [No Data]

Trojan.Win32.APosT.enw also known as:

How to remove Trojan.Win32.APosT.enw?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.