How to remove “Trojan:Win32/Redmem”?

The Trojan:Win32/Redmem is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Redmem virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Transacted Hollowing
• CAPE detected the embedded win api malware family
• Appears to use command line obfuscation
• Deletes executed files from disk
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Redmem?

File Info:
name: 815107DD9C7B6E008175.mlw
path: /opt/CAPEv2/storage/binaries/eaff08bdfdd4bcf8b7ef2b9a1c954cfc7bd5827cfda7f559b6d228f9e0c05574
crc32: 4ECA50FD
md5: 815107dd9c7b6e008175f9e4a66a5735
sha1: 70997b7eb5c8d3b0078768b651a70f8bd62fc4a1
sha256: eaff08bdfdd4bcf8b7ef2b9a1c954cfc7bd5827cfda7f559b6d228f9e0c05574
sha512: 81950f919a1a04919aaead433adacf8611db1891842649765a89a126c88b182a2674916bd567989d0756efc8e65e6ca15a24fe4a0deea711ba2271f40995e007
ssdeep: 98304:OWFsTuRN2zazBLlLvOc1Pgd1E20fzsFvOFg+DnUvUWJNR:OWFsTuRN2zahf1Y7E94rJ7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D5267C30765EC52AD56505F0592CAB9B911C6E3A0B61E0C7B3DC7E6F2B710CB0636E2B
sha3_384: 226cf6a8f5a1429a144d2d33eb9f8453ffdc7764d1dfdcf8e9044c1f88a3f8fc64a01cd02e9726a070da672d588fd623
ep_bytes: e836060000e978feffff558bec8325ac
timestamp: 2024-01-23 16:35:17

Version Info:
CompanyName: Your Company
FileDescription: Your Application Installer
FileVersion: 1.0.0
InternalName: testing
LegalCopyright: Copyright (C) 2024 Your Company
OriginalFileName: testing.exe
ProductName: Your Application
ProductVersion: 1.0.0
Translation: 0x0409 0x04b0

Trojan:Win32/Redmem also known as:

How to remove Trojan:Win32/Redmem?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.