What is “Trojan:Win32/Aenjaris!pz”?

The Trojan:Win32/Aenjaris!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Aenjaris!pz virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• Executed a command line with /V argument which modifies variable behaviour and whitespace allowing for increased obfuscation options
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• CAPE detected the shellcode get eip malware family
• Deletes executed files from disk
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Aenjaris!pz?

File Info:
name: A034170F70FDF51E75E3.mlw
path: /opt/CAPEv2/storage/binaries/0594a988bfb588750e92a8ffcf15faea683f0c61d5d674704132aee5c60d26ab
crc32: 9347E027
md5: a034170f70fdf51e75e38a5e6d5e0085
sha1: a0925c0861922342f388748376fe95922e4a3f0d
sha256: 0594a988bfb588750e92a8ffcf15faea683f0c61d5d674704132aee5c60d26ab
sha512: a073bbd9b1c49f65f28cbc787d86d1247ae60b506644f796a2b436844954ad38edfdf8d0f13f40ead13fbd9d06abc575062da4c0d2c2d4894a5b004e220058f6
ssdeep: 6144:3bmRFgIFN20q64ObKM/gMtezdWz57LDkEjiPISUOgW9X+hOGzC/NM:LmLgk2E4WKWteiLDkmZzcukG2/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11AA49054BBA49AA3F253013468DAF190A77A7870F394839B3414B33D22B7BE01577B6D
sha3_384: ae95574ed3f5e9aa068ddbfbbdcd2c03fdd3233f6311a9bcd51939d30a5a1b081d8a3f0698dc6e0c77585c03d8b4be88
ep_bytes: 60b99c3102008aa1ff0f400080f48d80
timestamp: 2007-06-02 06:27:43

Version Info:
CompanyName: TODO: 
FileDescription: TODO: 
FileVersion: 1.0.0.1
InternalName: AdwTest.exe
LegalCopyright: TODO: (c) .  All rights reserved.
OriginalFilename: AdwTest.exe
ProductName: TODO: 
ProductVersion: 1.0.0.1
Translation: 0x0409 0x04e4

Trojan:Win32/Aenjaris!pz also known as:

How to remove Trojan:Win32/Aenjaris!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.