Trojan

Trojan:Win32/Cnzzbot!rfn (file analysis)

Malware Removal

The Trojan:Win32/Cnzzbot!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Trojan:Win32/Cnzzbot!rfn virus can do?

  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Authenticode signature is invalid

How to determine Trojan:Win32/Cnzzbot!rfn?



File Info:

name: 0E708829E9717CB005D3.mlw
path: /opt/CAPEv2/storage/binaries/e4f029e87f7509dd49d8d21a2f831c6eff6a7c31eebf03de021c6d4503aa453e
crc32: A0F3B360
md5: 0e708829e9717cb005d344db0ee4353a
sha1: b339b7f9760eb990e1a990bde9b657646e89fabc
sha256: e4f029e87f7509dd49d8d21a2f831c6eff6a7c31eebf03de021c6d4503aa453e
sha512: 963cc5e3e3930b8e67ac4d16bf06a87ba161f014f248453a0c7cd5fdbfcfdfdb447e57152b65a48cf29926683accdf162e1c9712f6ce0575d8eac36571964c06
ssdeep: 24576:6VuAfrjmYAWRa5L4k1fs9JXfTvpk7BfjWtsEdf+:6IsPmYAWR6s9JXfLkredG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15A35234124A160B5C3969671C2B38F3BFA7B9E492B7029C717083A9B32750A7D753B73
sha3_384: 633f46d93253423f879d009494ce1b5472bff6c7e36dd497f5f3f83e39a7afaab844ffd64eb4d298bb1bf336e9ef8562
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2009-06-18 21:33:27


Version Info:

Comments: pcWeather365
CompanyName: 365气象工作室
FileDescription: 365桌面天气预报－PC端专用气象工具
FileVersion: 1.1.0.1002
LegalCopyright: Copyright (C) 2013 pcWeather365
LegalTrademarks: http://114tq.com/
ProductName: pcWeather365
Translation: 0x0804 0x03a8

Trojan:Win32/Cnzzbot!rfn also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.VB.4!c
DrWebTrojan.KillFiles.18376
MicroWorld-eScanTrojan.Generic.11483191
FireEyeTrojan.Generic.11483191
CAT-QuickHealTrojan.Sigmal.S1565461
ALYacGen:Variant.Ulise.98043
CylanceUnsafe
ZillyaAdware.Agent.Win32.33265
SangforSuspicious.Win32.Ulise.98043
K7AntiVirusRiskware ( 0040eff71 )
AlibabaTrojan:Win32/CnzzBot.20291ddf
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.9e9717
BitDefenderThetaGen:NN.ZexaCO.34062.hq0@aeoLGGjj
CyrenW32/Adware.TKAQ-5669
SymantecSMG.Heur!gen
ESET-NOD32a variant of Win32/CnzzBot.A
TrendMicro-HouseCallTROJ_SPNR.03JN14
ClamAVWin.Trojan.Generickd-1170
KasperskyTrojan.Win32.VB.cxzn
BitDefenderTrojan.Generic.11483191
NANO-AntivirusRiskware.Win32.Agent.dxuxdw
SUPERAntiSpywareTrojan.Agent/Gen-Bancos
AvastWin32:VBCrypt-CXB [Trj]
SophosMal/Generic-S (PUA)
ComodoMalware@#2fn3riyg12ul
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_SPNR.03JN14
McAfee-GW-EditionBehavesLike.Win32.Dropper.tc
EmsisoftTrojan.Generic.11483191 (B)
JiangminTrojan/VB.cwpn
AviraTR/Dynamer.dtc.18258
MAXmalware (ai score=85)
Antiy-AVLTrojan/Generic.ASMalwNS.80
GridinsoftRansom.Win32.Zbot.sa
MicrosoftTrojan:Win32/Cnzzbot!rfn
GDataGen:Variant.Ulise.98043
CynetMalicious (score: 99)
AhnLab-V3Spyware/Win32.Bancos.C323735
McAfeeArtemis!0E708829E971
VBA32AdWare.Agent
MalwarebytesMalware.AI.1594755673
APEXMalicious
TencentWin32.Trojan.Vb.Hyu
FortinetW32/Generic.AP.6D9C82!tr
AVGWin32:VBCrypt-CXB [Trj]
PandaTrj/CI.A

How to remove Trojan:Win32/Cnzzbot!rfn?

Trojan:Win32/Cnzzbot!rfn removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment