What is “Trojan:Win32/Znyonm”?

The Trojan:Win32/Znyonm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Znyonm virus can do?

Sample contains Overlay data
Authenticode signature is invalid
CAPE detected the MetaStealer malware family
Binary file triggered YARA rule
Binary compilation timestomping detected

How to determine Trojan:Win32/Znyonm?


File Info:
name: 13E89D800B308F08FF8B.mlw
path: /opt/CAPEv2/storage/binaries/2fbc2df2ab79b98608500cb7735eb1ec5bb45e27c26a7a86a597b584b7b0aaa8
crc32: 26AAF509
md5: 13e89d800b308f08ff8b2d64ad730af1
sha1: 85185081e010274b046aeb2e5b1524760ce2fe4e
sha256: 2fbc2df2ab79b98608500cb7735eb1ec5bb45e27c26a7a86a597b584b7b0aaa8
sha512: 8d21892c79efb57d195d61c3a6c6bbd584888aa4f2b1b1e5094432cfbd6e5848156b5b705b0f3f2577799a8dd0a59e78ce149fd99173e5949d47e006eda40778
ssdeep: 3072:D47FCYO0NJQ5S0xNcIA7qVJeNGt8e8hy:Dvd0AEnCVJeNGt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17C14D5583647A97EC96F887D9C700CE4677CAC671246AB079C8EF0E83D3A7819E051F6
sha3_384: 9eeef3f0392448afaa6f47231333300ad7bb149bab12ab877a9e524eed9e47e1038241e4ece6d2cc1f7db5c4b8a5b144
ep_bytes: 737061636506456e7469747926010002
timestamp: 2091-04-18 04:44:29

Version Info:
0: [No Data]

Trojan:Win32/Znyonm also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Generic.4!c
Elastic	Windows.Trojan.Generic
Cynet	Malicious (score: 100)
FireEye	Generic.mg.13e89d800b308f08
Skyhigh	BehavesLike.Win32.Generic.cm
McAfee	GenericRXWD-BX!13E89D800B30
Cylance	unsafe
VIPRE	Gen:Variant.Fragtor.339039
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.00b308
Arcabit	Trojan.Fragtor.D52C5F
VirIT	Trojan.Win32.GenusT.DOTL
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
APEX	Malicious
ClamAV	Win.Packed.Lazy-9958163-0
BitDefender	Gen:Variant.Fragtor.339039
MicroWorld-eScan	Gen:Variant.Fragtor.339039
Avast	Win32:Malware-gen
Emsisoft	Gen:Variant.Fragtor.339039 (B)
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.RedLine
Varist	W32/MSIL_Troj.CQM.gen!Eldorado
Antiy-AVL	Trojan/Win32.SGeneric
Kingsoft	malware.kb.a.998
Microsoft	Trojan:Win32/Znyonm
GData	Win32.Trojan-Spy.Redline.H
Google	Detected
AhnLab-V3	Malware/Win.Generic.R590364
ALYac	Gen:Variant.Fragtor.339039
MAX	malware (ai score=88)
Malwarebytes	Generic.Spyware.Stealer.DDS
Rising	Stealer.Agent!1.E5F0 (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.218665841.susgen
Fortinet	MSIL/RedLineStealer.205B!tr.spy
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Trojan:Win32/Znyonm?

Trojan:Win32/Znyonm removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X