Trojan.Win32.Runner.jaa removal guide

Malware Removal

The Trojan.Win32.Runner.jaa is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan.Win32.Runner.jaa virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Detected script timer window indicative of sleep style evasion
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Executed a very long command line or script command which may be indicative of chained commands or obfuscation
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Creates a hidden or system file
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

lu1.asia
asu04.shop
asu03.xyz
lu0.viewdns.net

How to determine Trojan.Win32.Runner.jaa?


File Info:

crc32: 78F90E74
md5: 15467567c301ef6ae8b98d4fafb6db67
name: 15467567C301EF6AE8B98D4FAFB6DB67.mlw
sha1: 9884574ad77b49580ab14047342b4580324cb6ee
sha256: 9db5c02ac4e161369160fe13719a212e55377dd57ffc9f98b7141bce3b9df26c
sha512: 5b3d68e59a908312a8e009d2b6ec4af06be67ee7a762d996ed914de9c00bf5edd57dd38f8eaac52bff5ff8a42e7760b7503b517c671bffc37bb55327b37382b1
ssdeep: 48:6gmQ3iqZ2z5LUB9wmVe/+3iqZ2z5LUBs3aDlaBSh:HZ2VoDwmrZ2VoouaA
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:

0: [No Data]

Trojan.Win32.Runner.jaa also known as:

BkavW32.AIDetect.malware1
K7AntiVirusRiskware ( 0040eff71 )
LionicTrojan.Win32.Runner.4!c
Elasticmalicious (high confidence)
DrWebTrojan.DownLoader40.35475
CynetMalicious (score: 100)
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_90% (W)
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.ad77b4
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/TrojanDownloader.Agent.FSG
APEXMalicious
AvastWin32:Malware-gen
KasperskyTrojan.Win32.Runner.jaa
BitDefenderTrojan.GenericKD.37222224
MicroWorld-eScanTrojan.GenericKD.37222224
Ad-AwareTrojan.GenericKD.37222224
SophosMal/Generic-S
BitDefenderThetaGen:NN.ZexaE.34790.aiW@a8BlIqi
McAfee-GW-EditionArtemis!Trojan
FireEyeGeneric.mg.15467567c301ef6a
EmsisoftTrojan.GenericKD.37222224 (B)
SentinelOneStatic AI – Suspicious PE
WebrootW32.Trojan.Gen
AviraTR/Runner.owcbl
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftTrojan:Win32/Bomitag.D!ml
GDataTrojan.GenericKD.37222224
McAfeeArtemis!15467567C301
MAXmalware (ai score=82)
FortinetPossibleThreat.MU
AVGWin32:Malware-gen
Qihoo-360HEUR/QVM20.1.8CA4.Malware.Gen

How to remove Trojan.Win32.Runner.jaa?

Trojan.Win32.Runner.jaa removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment