Trojan:Win32/Hynamer.C!ml removal

Malware Removal

The Trojan:Win32/Hynamer.C!ml is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Review

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan:Win32/Hynamer.C!ml virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (4 unique times)
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Arabic (Tunisia)
  • The binary likely contains encrypted or compressed data.
  • Attempts to identify installed AV products by installation directory
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Attempts to modify proxy settings
  • Attempts to create or modify system certificates
  • Anomalous binary characteristics

Related domains:

iplogger.org
apps.identrust.com
greenpalace.top

How to determine Trojan:Win32/Hynamer.C!ml?


File Info:

crc32: 079B899D
md5: 53bead9f9e25c9411b8b2718626e304d
name: infostat.exe
sha1: 34af0c0ffedda759dcd913c29ec883d0e44d5f81
sha256: 92b8718fd64c7d13e9ea54a69ac7c1a52b57680d34c74d38c2b8ac1eb53f217c
sha512: 7209446e61f770f4c627abe1095ee51ef4f03f828b4e0e03d77a47fe8024f2ca07515f60dd1ba73af8fe03f2f08a9e6fd87097b26c0cf8f36e4530ad58d337d8
ssdeep: 12288:Karb8erySzXfP2in7Eww4oQzb6xZrqVIeZ9b8Hczv6bH42d50vqFC8:Kasyy2X2GQww4oQH6xZroLb86CbpNv
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translations: 0x0292 0x03dd

Trojan:Win32/Hynamer.C!ml also known as:

BkavHW32.Packed.
MicroWorld-eScanTrojan.GenericKD.43403170
FireEyeGeneric.mg.53bead9f9e25c941
CAT-QuickHealRansom.Stop.MP4
McAfeeArtemis!53BEAD9F9E25
SangforMalware
CrowdStrikewin/malicious_confidence_90% (W)
BitDefenderTrojan.GenericKD.43403170
K7GWTrojan ( 005643101 )
K7AntiVirusTrojan ( 005643101 )
Invinceaheuristic
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HEMI
TrendMicro-HouseCallTrojan.Win32.WACATAC.THFBHBO
Paloaltogeneric.ml
GDataWin32.Trojan.AutoHotkey.USQGU9
KasperskyTrojan-Downloader.Win32.Stralo.sy
AegisLabTrojan.Win32.Malicious.4!c
APEXMalicious
Ad-AwareTrojan.GenericKD.43403170
SophosMal/Generic-S
TrendMicroTrojan.Win32.WACATAC.THFBHBO
EmsisoftTrojan.GenericKD.43403170 (B)
IkarusWin32.Outbreak
AviraTR/AD.AHKInfoSteal.uobrt
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D10AA3
ZoneAlarmTrojan-Downloader.Win32.Stralo.sy
MicrosoftTrojan:Win32/Hynamer.C!ml
CynetMalicious (score: 100)
Acronissuspicious
MAXmalware (ai score=88)
RisingDownloader.Stralo!8.1147C (CLOUD)
SentinelOneDFI – Malicious PE
eGambitUnsafe.AI_Score_77%
FortinetW32/Kryptik.HEMI!tr
Cybereasonmalicious.ffedda

How to remove Trojan:Win32/Hynamer.C!ml?

Trojan:Win32/Hynamer.C!ml removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment