Categories: Trojan

TrojanDownloader:Win32/Sinresby!pz removal guide

The TrojanDownloader:Win32/Sinresby!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Sinresby!pz virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Presents an Authenticode digital signature
CAPE extracted potentially suspicious content
Drops a binary and executes it
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Deletes executed files from disk
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrojanDownloader:Win32/Sinresby!pz?


File Info:
name: 808442EDBB7E2ACA7790.mlwpath: /opt/CAPEv2/storage/binaries/4746dc2345065dbdc87659267f71f03ca70a33fa9fa155141585a2e8ba354fe2crc32: 2CDD3BBDmd5: 808442edbb7e2aca77902b02016fdba9sha1: 493fd1cfade29553748d022450461e07137d0c11sha256: 4746dc2345065dbdc87659267f71f03ca70a33fa9fa155141585a2e8ba354fe2sha512: 69445bf7a11f913b78bfbe195f7613ed76b92b4e5378b3baf3ec259acde58b2bc34b2c001a87a4d2f4c374da13e9e8476de1ccd6ebdfed448e2530c60790e2a6ssdeep: 196608:kZUUDQ7Ej9LCs9RVKTwbY4gE8ismOWQEqns00E/rC4hco17FiNwrxPksVp+aUskq:ka0Q7E19aoY4g233FE/e4hH17MNW5kW5type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D7C633806180EDC0D74DB071DDE5C6F163967CB4F45E0A4360FEBE6771BA38A88E5A92sha3_384: 0b8ba15a53fe8311b342be676858ff3418ddcea280cf590924a649bf1965c5bd9937ae29217aa05250b787992eda65b0ep_bytes: 60be0050f8008dbe00c047ff5789e58dtimestamp: 2023-08-08 13:53:23
Version Info:
FileVersion: 1.0.0.0FileDescription: 专业下载器ProductName: 专业下载器ProductVersion: 1.0.0.0LegalCopyright: 作者版权所有 请尊重并使用正版Comments: 本程序使用易语言编写(http://www.eyuyan.com)Translation: 0x0804 0x04b0

TrojanDownloader:Win32/Sinresby!pz also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Bsymem.4!c
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Trojan.GenericKD.70701387
Skyhigh	Artemis!Trojan
McAfee	Artemis!808442EDBB7E
Cylance	unsafe
VIPRE	Trojan.GenericKD.70701387
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Adware ( 005848221 )
K7GW	Adware ( 005848221 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D436D14B
BitDefenderTheta	Gen:NN.ZexaF.36680.@pMfa0CF3gob
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	Trojan.Win32.Bsymem.aobh
BitDefender	Trojan.GenericKD.70701387
NANO-Antivirus	Trojan.Win32.Bsymem.kewrtu
Avast	Win32:TrojanX-gen [Trj]
Emsisoft	Trojan.GenericKD.70701387 (B)
F-Secure	Trojan.TR/Bsymem.yepny
Zillya	Trojan.Bsymem.Win32.5277
TrendMicro	TROJ_GEN.R002C0WLC23
Sophos	Generic Reputation PUA (PUA)
Ikarus	Trojan.Win32
Jiangmin	Trojan.Bsymem.csi
Webroot	W32.Malware.Gen
Varist	W32/ABRisk.JURR-2895
Avira	TR/Bsymem.yepny
Antiy-AVL	Trojan[Packed]/Win32.FlyStudio
Microsoft	TrojanDownloader:Win32/Sinresby!pz
ZoneAlarm	Trojan.Win32.Bsymem.aobh
GData	Win32.Trojan.PSE.15MID6N
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R581001
MAX	malware (ai score=80)
Malwarebytes	Trojan.MalPack.FlyStudio
TrendMicro-HouseCall	TROJ_GEN.R002C0WLC23
Rising	Trojan.ShellCodeRunner!1.ED43 (CLOUD)
SentinelOne	Static AI – Malicious PE
MaxSecure	Dropper.Dinwod.frindll
Fortinet	W32/CoinMiner.PHP!tr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.fade29
DeepInstinct	MALICIOUS