What is “Trojan:Win32/Znyonm”?

The Trojan:Win32/Znyonm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Znyonm virus can do?

Sample contains Overlay data
Authenticode signature is invalid
CAPE detected the MetaStealer malware family
Binary file triggered YARA rule
Binary compilation timestomping detected

How to determine Trojan:Win32/Znyonm?


File Info:
name: EAB8AA2A7FBDF76D060C.mlw
path: /opt/CAPEv2/storage/binaries/69b523edd009dacb53f1c0f1a4341fb651838d9f30cac99b53a0a85755f743e9
crc32: AF4FBF78
md5: eab8aa2a7fbdf76d060caef52ff51155
sha1: 4719390a8cb301200107fb910dd7cea47209b8aa
sha256: 69b523edd009dacb53f1c0f1a4341fb651838d9f30cac99b53a0a85755f743e9
sha512: fe0478137d615c3eed0e2f471c219b87772eb5346e85e3c9f0c324c23f5e1d6abf04dc73bd46127c31d059746c4603382dbf3f06a18dd3555aff357784fa70a0
ssdeep: 3072:LtE62xyQ6d+VeXdxNLgVK880EHy8e8hK:5EmOA9S80EHy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19714D558364B657ECA6F887D9C700CD06B7CAC671246AB078D8EF4E8393B7819B151F2
sha3_384: 6e4a2d5b2c0b4d22d1f68adead901de6b09dfa545351462524c7e1a1f99d64964f641f03480e93076c391f6769a2afd3
ep_bytes: 6506456e746974792601000200540e04
timestamp: 2065-10-06 00:48:36

Version Info:
0: [No Data]

Trojan:Win32/Znyonm also known as:

Bkav	W32.AIDetectMalware.CS
ClamAV	Win.Packed.Lazy-9958163-0
FireEye	Generic.mg.eab8aa2a7fbdf76d
Skyhigh	BehavesLike.Win32.Generic.cm
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
VirIT	Trojan.Win32.GenusT.DOTL
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Trojan.Generic
APEX	Malicious
Cynet	Malicious (score: 100)
Rising	Stealer.Agent!1.E5F0 (CLASSIC)
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.RedLine
Google	Detected
Antiy-AVL	Trojan/MSIL.RedLineStealer
Kingsoft	malware.kb.a.998
Microsoft	Trojan:Win32/Znyonm
GData	Win32.Trojan-Spy.Redline.H
Varist	W32/MSIL_Troj.CQM.gen!Eldorado
AhnLab-V3	Malware/Win.Generic.C5449947
McAfee	GenericRXWC-TY!EAB8AA2A7FBD
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Spyware.Stealer.DDS
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/RedLineStealer.205B!tr.spy
AVG	Win32:MalwareX-gen [Trj]
Avast	Win32:MalwareX-gen [Trj]

How to remove Trojan:Win32/Znyonm?

Trojan:Win32/Znyonm removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X