Categories: Trojan

TrojanDownloader:Win32/Sinresby!pz malicious file

The TrojanDownloader:Win32/Sinresby!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Sinresby!pz virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Presents an Authenticode digital signature
CAPE extracted potentially suspicious content
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Deletes executed files from disk
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanDownloader:Win32/Sinresby!pz?


File Info:
name: FD172B78A8C6DD63E4A5.mlwpath: /opt/CAPEv2/storage/binaries/d21835f8f057bfad11e87430077ef95a1d64f2b784fbb71a19a5c1b6bd392a5ecrc32: 35D0DCC5md5: fd172b78a8c6dd63e4a5db73988bfc03sha1: abad695720dd96a62ed7eabd77291d411bdd2badsha256: d21835f8f057bfad11e87430077ef95a1d64f2b784fbb71a19a5c1b6bd392a5esha512: cd171a0fcbce677f188670920cdc348a52db752561bfc20617e30048bb6093a60bfc8484a0c32641a549f2269fcbe9abbcd71f0d8a061610e75bd27c91fb8fc0ssdeep: 196608:vc+jCTYE55FAsdtk4iKCxG6J5iCRnzuzBaW+028m8ZsRieAbBLEPkSeqLo4ng:vR6Ye5ZdYKCx/r4EK28/sYea4PbxLomgtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T144C633C5B1A1C0A0C6662D76FCEFF1F42B166D24EAC4580321D6FD5337B29732A299C6sha3_384: 663d8a28fac33eeef6b2dca4f8114e8e98e55fbb8b07708c3f1bafe309ac3bf84b1faf3832d071561d19fc6da3ae2f2cep_bytes: 60be0070f8008dbe00a047ff5789e58dtimestamp: 2023-08-08 13:53:23
Version Info:
FileVersion: 1.0.0.0FileDescription: 专业下载器ProductName: 专业下载器ProductVersion: 1.0.0.0LegalCopyright: 作者版权所有 请尊重并使用正版Comments: 本程序使用易语言编写(http://www.eyuyan.com)Translation: 0x0804 0x04b0

TrojanDownloader:Win32/Sinresby!pz also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.FlyStudio.4!c
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Variant.Zusy.530868
FireEye	Generic.mg.fd172b78a8c6dd63
Skyhigh	Artemis!Trojan
ALYac	Gen:Variant.Zusy.530868
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Adware ( 0050718d1 )
K7GW	Adware ( 0050718d1 )
CrowdStrike	win/malicious_confidence_60% (W)
Arcabit	Trojan.Zusy.D819B4
BitDefenderTheta	Gen:NN.ZexaF.36608.@pMfaayZxIkb
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
Cynet	Malicious (score: 100)
APEX	Malicious
BitDefender	Gen:Variant.Zusy.530868
Avast	Win32:TrojanX-gen [Trj]
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Dldr.Sinresby.wlsaj
VIPRE	Gen:Variant.Zusy.530868
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Zusy.530868 (B)
Ikarus	Trojan.Win32
Webroot	W32.Malware.Gen
Avira	TR/Dldr.Sinresby.wlsaj
Antiy-AVL	Trojan[Packed]/Win32.FlyStudio
Microsoft	TrojanDownloader:Win32/Sinresby!pz
GData	Win32.Trojan.PSE.15MID6N
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R581001
McAfee	Artemis!FD172B78A8C6
MAX	malware (ai score=87)
Malwarebytes	Trojan.MalPack.FlyStudio
Rising	Trojan.ShellCodeRunner!1.ED43 (CLOUD)
SentinelOne	Static AI – Malicious PE
MaxSecure	Dropper.Dinwod.frindll
Fortinet	W32/CoinMiner.PHP!tr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.720dd9
DeepInstinct	MALICIOUS