Categories: Trojan

TrojanDownloader:Win32/Renos.OD removal guide

The TrojanDownloader:Win32/Renos.OD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Renos.OD virus can do?

Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanDownloader:Win32/Renos.OD?


File Info:
name: ACCD5AFB130D62786C08.mlwpath: /opt/CAPEv2/storage/binaries/3f3074fbac8d181339dbad053bd1ca0f90ec7dc8ddc8bf6c6c6f966e63b483e9crc32: CF217485md5: accd5afb130d62786c08eba908610e13sha1: 6fc30c712cb269e88272104195704cf834ceaceesha256: 3f3074fbac8d181339dbad053bd1ca0f90ec7dc8ddc8bf6c6c6f966e63b483e9sha512: f9b7ccc79b2503aa750fc121612345d088d2756cc6c45f7d6a3e7bae56b17164d2967ddda2695b087583cd19072dbb9ac55aa465da62b904ca72323e9f06d26essdeep: 1536:DyvzcUlHSTFpShDz9B04KMMxcydYfzusBXI/rPukl6fVaP5WfuGNweNBPR8iZCSi:2vzcaA7ShoMjAYfznK/brQRNwebmcotype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T189A3E0A4B689D804CCDE09B6C47B4FF929563D24DE53910786973E1ABD3F50AAE03A13sha3_384: 06ff5b9b7e0617a9a61040d5e7fe9c444a96a6467e370471584733756cd4cd9321ab837a5b16601c139d07256b9cab65ep_bytes: 60be002042008dbe00f0fdff57eb0b90timestamp: 1992-06-19 22:22:17
Version Info:
CompanyName: .KLite .Codec .PackFileDescription: .KLite .Codec .PackFileVersion: 9.1.4.1InternalName: .KLite .Codec .PackLegalCopyright: .KLite .Codec .PackLegalTrademarks: .KLite .Codec .PackOriginalFilename: .KLite .Codec .PackProductName: .KLite .Codec .PackProductVersion: 11.4.2.5Translation: 0x041b 0x04e2

TrojanDownloader:Win32/Renos.OD also known as:

Bkav	W32.FakeWmpQKB.Fam.Trojan
Lionic	Virus.Win32.Krap.lly4
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Variant.Renos.48
FireEye	Gen:Variant.Renos.48
CAT-QuickHeal	Trojan.Renos.KF
Skyhigh	Downloader-CEW.r
ALYac	Gen:Variant.Renos.48
Malwarebytes	Crypt.Trojan.Malicious.DDS
VIPRE	Gen:Variant.Renos.48
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 004b8fd51 )
BitDefender	Gen:Variant.Renos.48
K7GW	Trojan-Downloader ( 004b8fd51 )
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.Generic.BPEH
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrojanDownloader.FakeAlert.BBT
APEX	Malicious
ClamAV	Win.Trojan.Downloader-16430
Kaspersky	Trojan-Downloader.Win32.CodecPack.sjt
Alibaba	TrojanDownloader:Win32/CodecPack.60f2398f
NANO-Antivirus	Trojan.Win32.CodecPack.inlsh
ViRobot	Trojan.Win32.Downloader.105984.AC
Rising	Downloader.Renos!8.1D0 (TFE:5:3aWgGsxZJoL)
Emsisoft	Gen:Variant.Renos.48 (B)
F-Secure	Trojan-Downloader:W32/Renos.GTB
DrWeb	Trojan.DownLoad2.19163
Zillya	Trojan.FakeAV.Win32.38015
TrendMicro	TROJ_RENOS.SMB
Trapmine	malicious.high.ml.score
Sophos	Mal/FakeAV-GX
Ikarus	Trojan-Downloader.Win32.CodecPack
Jiangmin	TrojanDownloader.CodecPack.emr
Google	Detected
Avira	TR/Agent.103936.22
Varist	W32/FakeAlert.JO.gen!Eldorado
Antiy-AVL	Trojan[Downloader]/Win32.CodecPack.sjt
Kingsoft	Win32.HeurC.KVM007.a
Microsoft	TrojanDownloader:Win32/Renos.OD
Xcitium	TrojWare.Win32.Kryptik.AAA@2hs9cq
Arcabit	Trojan.Renos.48
ZoneAlarm	Trojan-Downloader.Win32.CodecPack.sjt
GData	Gen:Variant.Renos.48
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.FakeAV.R2261
Acronis	suspicious
McAfee	GenericRXAA-FA!ACCD5AFB130D
MAX	malware (ai score=100)
DeepInstinct	MALICIOUS
VBA32	Malware-Cryptor.Limpopo
Cylance	unsafe
Panda	Trj/Renos.gen
TrendMicro-HouseCall	TROJ_RENOS.SMB
Tencent	Malware.Win32.Gencirc.1159d0a4
Yandex	Trojan.GenAsa!E+VaVMVRSdk
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CodePack.ABT!tr
BitDefenderTheta	Gen:NN.ZelphiF.36792.gmKfamocNamc
AVG	Win32:Downloader-FCS [Trj]
Cybereason	malicious.12cb26
Avast	Win32:Downloader-FCS [Trj]