TrojanDownloader:Win32/Renos!pz (file analysis)

The TrojanDownloader:Win32/Renos!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Renos!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• HTTPS urls from behavior.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Enumerates physical drives
• Attempted to write directly to a physical drive
• Attempts to modify proxy settings
• Deletes executed files from disk
• Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDownloader:Win32/Renos!pz?

File Info:
name: 565B5896F3DE9B77AD52.mlw
path: /opt/CAPEv2/storage/binaries/ca9d6d3b9b368b421b9f935ac49946ea33ee43510f3d842e6197e146c2732e0c
crc32: 78C7DAD5
md5: 565b5896f3de9b77ad529e3b1fd6e93f
sha1: 3591a18780f3dca614ebbc1e20eded559110ee85
sha256: ca9d6d3b9b368b421b9f935ac49946ea33ee43510f3d842e6197e146c2732e0c
sha512: e4cce7104e6407a19c2585c8b483b5ecf335af542cc0a29f443768adec566a7c00e592e90399201dab832c9862c88cd09f98703cbf15162d1b7f447b46c9290d
ssdeep: 6144:2bN543HF4MZtSoBp0J3efUWhPo5npt88pNGiZCnXizxsQmluJMibMGp8i:24140qxNpC8qigMxTmlzPGp8i
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19D9423C7ACC40927DE143A335523FE69A2736FA6067A69534B542FD81B19307FB1F10A
sha3_384: aecd19d49e99955df0c43fbaa9c70077a98b88e1729a7d67e315728e49081ac2c572bb9ff1ace898809abe5f0c9a0c52
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2009-02-21 19:46:23

Version Info:
0: [No Data]

TrojanDownloader:Win32/Renos!pz also known as:

How to remove TrojanDownloader:Win32/Renos!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.