Trojan.Win32.Zenpak.axwq (file analysis)

The Trojan.Win32.Zenpak.axwq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Zenpak.axwq virus can do?

Executable code extraction
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
A process created a hidden window
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan.Win32.Zenpak.axwq?


File Info:
crc32: FEA35622
md5: 66af0f7da86f6a40cc3ab7477bcbcfbb
name: kv.gif
sha1: 13b38950c11624ec3045434b2658ac673a6ae0fb
sha256: 1b7c48a472a51183a0a9e542b6168f15d41868d820ae9c367f543009af40cc2e
sha512: 72291562c84395956d411f9133bda072680f4513071c991c121786e6708bce29c2492ce47c00d0905d6a00e0398df86fd3378896e056429a74776412eaa4e8c0
ssdeep: 6144:qdtJ9rtpMBa7CSqNF2+Nlu/of4jHwr68M:qd1rMBgCSqY+Nloof4Hw2
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 Headlight Software, Inc.  All rights reserved.
InternalName: AdminPrivSetting.exe
FileVersion: 1.0.6.5
CompanyName: Headlight Software, Inc.
ProductName: (Shared by Headlight Software Products)
ProductVersion: 1.0.6.5
FileDescription: Change Settings that need Admin Privileges
OriginalFilename: AdminPrivSetting.exe
Translation: 0x0409 0x04e4

Trojan.Win32.Zenpak.axwq also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.70967
FireEye	Generic.mg.66af0f7da86f6a40
CAT-QuickHeal	Trojan.Zenpak
McAfee	W32/PinkSbot-HG!66AF0F7DA86F
Sangfor	Malware
K7AntiVirus	Spyware ( 0040f0131 )
BitDefender	Trojan.GenericKDZ.70967
K7GW	Spyware ( 0040f0131 )
Cybereason	malicious.0c1162
TrendMicro	TROJ_GEN.R002C0WJQ20
Cyren	W32/Trojan.JJLQ-5636
Symantec	Packed.Generic.459
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Zenpak.axwq
Alibaba	Backdoor:Win32/KZip.388820a2
AegisLab	Hacktool.Win32.Krap.lKMc
Tencent	Malware.Win32.Gencirc.10ce0e43
Ad-Aware	Trojan.GenericKDZ.70967
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Inject4.3909
Invincea	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Trojan.dc
Emsisoft	Trojan.Crypt (A)
Ikarus	Trojan.Win32.Krypt
GData	Win32.Trojan.QakBot.A5FHY9
Avira	TR/Dropper.Gen
MAX	malware (ai score=85)
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Arcabit	Trojan.Generic.D11537
SUPERAntiSpyware	Trojan.Agent/Generic
ZoneAlarm	Trojan.Win32.Zenpak.axwq
Microsoft	Trojan:Win32/Qakbot.AR!MTB
AhnLab-V3	Trojan/Win32.Kryptik.R353992
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34590.py0@aGnHXEei
ALYac	Trojan.GenericKDZ.70967
TACHYON	Trojan/W32.Agent.247296.JZ
VBA32	BScope.Malware-Cryptor.Hlux
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/GenKryptik.EVBB
TrendMicro-HouseCall	TROJ_GEN.R002C0WJQ20
Rising	Malware.Obscure/Heur!1.A89E (CLASSIC)
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	W32/GenKryptik.EVBB!tr
AVG	Win32:BankerX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Trojan.28f

How to remove Trojan.Win32.Zenpak.axwq?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.Win32.Zenpak.axwq (file analysis)