Trojan.Win32.Invader malicious file

The Trojan.Win32.Invader is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Invader virus can do?

Injection (inter-process)
Injection (Process Hollowing)
Executable code extraction
Attempts to connect to a dead IP:Port (3 unique times)
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Loads a driver
Expresses interest in specific running processes
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Attempts to create or modify system certificates
Attempts to interact with an Alternate Data Stream (ADS)
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

dssp.workday360.cn

a.eastfn.com

How to determine Trojan.Win32.Invader?


File Info:
crc32: AF327D20
md5: b844d8fd2faac77effc3633240e57b81
name: union_plugin_219bee0f6b20407575f536306c6fd405_de1afttd.exe
sha1: 82fd336e0f5baab6c26f648081400dfd957993aa
sha256: a19ee9645c0140e46948222d416d36081757226aee79a3c81073e8399ce0116d
sha512: 6bb1b6a31c174686cc6bbfc2fe6a43f7bf602d3e98969bd2b92cceae9efed3bc3d07d8ca743475657c7137b9c04812246413d425cdd7015bfe033b35a9be9fe0
ssdeep: 24576:Xj+TFi3WztwW9fPISZpI+vdS+Ed6gbZxCL5er5AEfe4UlGioi+JPVQmU2oZ1Sq:XatwqICaKPEUsz6EfesioiuOmy1Sq
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Trojan.Win32.Invader also known as:

FireEye	Generic.mg.b844d8fd2faac77e
Cylance	Unsafe
Sangfor	Malware
Cybereason	malicious.e0f5ba
BitDefenderTheta	Gen:NN.ZexaF.34080.BvW@aCJWtnlj
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Invader
Rising	Malware.Heuristic!ET#84% (RDMK:cmRtazrwy3ZRxeYfXeqSfwaGNaiY)
F-Secure	Trojan.TR/Dropper.Gen
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Trapmine	malicious.moderate.ml.score
Avira	TR/Dropper.Gen
Endgame	malicious (high confidence)
ZoneAlarm	HEUR:Trojan.Win32.Invader
Microsoft	Trojan:Win32/Wacatac.B!ml
Acronis	suspicious
Tencent	Win32.Trojan.Generic.Pezc
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_100%
AVG	FileRepMetagen [Malware]
CrowdStrike	win/malicious_confidence_70% (D)
Qihoo-360	Generic/HEUR/QVM10.2.6223.Malware.Gen

How to remove Trojan.Win32.Invader?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.Win32.Invader malicious file