TrojanDownloader:Win32/Renos.LE (file analysis)

The TrojanDownloader:Win32/Renos.LE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Renos.LE virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The executable is compressed using UPX
• Authenticode signature is invalid
• Queries information on disks, possibly for anti-virtualization
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Creates a copy of itself

How to determine TrojanDownloader:Win32/Renos.LE?

File Info:
name: 3EBD78090FF8D21D3F28.mlw
path: /opt/CAPEv2/storage/binaries/a4e30f9c265515ae8dec64ddd17a9edf9b311ac495052b4a02e539a6f5c42aa3
crc32: AD179068
md5: 3ebd78090ff8d21d3f286e69c062b1ca
sha1: 09483778a36d680d3e2d822ceefdd0dc5a47cdc4
sha256: a4e30f9c265515ae8dec64ddd17a9edf9b311ac495052b4a02e539a6f5c42aa3
sha512: 5b93f5d245f6bdc5576801fdb0ea72fdbf55a4ab256aeedb2002fdf2289fd92120c467d633bd110f6901a5329035fe26904a6b4f852efae7245eb91ab3a75838
ssdeep: 3072:w1DkAVr0PDDEK8OC2vXqOdQ7oGA5DlfbzZZnzg9dY6rNWWjOUA53:wZ0PcKDfqKQoGexzzgHY6rNWWjOU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15CB4122DE6AF3961E7B761F72E08873254791A326962C7613770B717301D0E3632938B
sha3_384: 479155e192b7e6130591e3db049e319fe2cf2c518f0ff5a883a2a87ce608cecf513fbe74c746de763dd779b50eafee3c
ep_bytes: 558bec81ecc00200000b4580e81ffbff
timestamp: 2007-12-06 19:27:56

Version Info:
0: [No Data]

TrojanDownloader:Win32/Renos.LE also known as:

How to remove TrojanDownloader:Win32/Renos.LE?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.