Trojan:Win32/Znyonm removal

The Trojan:Win32/Znyonm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Znyonm virus can do?

Sample contains Overlay data
Authenticode signature is invalid
CAPE detected the MetaStealer malware family
Binary file triggered YARA rule
Binary compilation timestomping detected

How to determine Trojan:Win32/Znyonm?


File Info:
name: 1732787DB3B038C67656.mlw
path: /opt/CAPEv2/storage/binaries/b1a0f76e056b05e5039926f152705a191d8f36c833bf72a30388a670bbc083f1
crc32: 2FBE1B49
md5: 1732787db3b038c6765650bc68dfc7ff
sha1: 7a81564505827ed4e3d1f0b350d7d4a567cf2a66
sha256: b1a0f76e056b05e5039926f152705a191d8f36c833bf72a30388a670bbc083f1
sha512: baaa6229c30de4b1b65fdce8b3c4ab2cf2209b7ba9bfe77527567fa87a14a518a3d5b729689a97d4d5b1be93b8099ed2e8c5530aca688d0293ad434d79398426
ssdeep: 3072:C47FCYO0NJQ5S0xNcIA7qVJeNG98e8hy:Cvd0AEnCVJeNG9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16014D5583647A97EC96F887D9C700CE4677CAC671246AB079C8EF0E83D3A7819E051F6
sha3_384: 332a7a220f44f0e74fa0191e9a55df5b882279b3b3c6b8c7d095993c16ae34b7c5e626206818c976fc90b1c28d2fc17a
ep_bytes: 737061636506456e7469747926010002
timestamp: 2091-04-18 04:44:29

Version Info:
0: [No Data]

Trojan:Win32/Znyonm also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Generic.4!c
Elastic	Windows.Trojan.Generic
MicroWorld-eScan	Gen:Variant.Fragtor.339039
FireEye	Generic.mg.1732787db3b038c6
Skyhigh	BehavesLike.Win32.Generic.cm
McAfee	GenericRXWD-BX!1732787DB3B0
Malwarebytes	Generic.Spyware.Stealer.DDS
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.db3b03
VirIT	Trojan.Win32.GenusT.DOTL
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Packed.Lazy-9958163-0
BitDefender	Gen:Variant.Fragtor.339039
Rising	Stealer.Agent!1.E5F0 (CLASSIC)
Sophos	Mal/Generic-S
VIPRE	Gen:Variant.Fragtor.339039
Emsisoft	Gen:Variant.Fragtor.339039 (B)
Ikarus	Trojan.MSIL.RedLine
ALYac	Gen:Variant.Fragtor.339039
Varist	W32/MSIL_Troj.CQM.gen!Eldorado
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.SGeneric
Kingsoft	malware.kb.a.998
Microsoft	Trojan:Win32/Znyonm
Arcabit	Trojan.Fragtor.D52C5F
GData	Win32.Trojan-Spy.Redline.H
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Generic.R590364
Google	Detected
Cylance	unsafe
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.218665841.susgen
Fortinet	MSIL/RedLineStealer.205B!tr.spy
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Trojan:Win32/Znyonm?

Trojan:Win32/Znyonm removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X