Trojan:Win32/Znyonm malicious file

The Trojan:Win32/Znyonm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Znyonm virus can do?

Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Znyonm?


File Info:
name: 42F24355C9161314A354.mlw
path: /opt/CAPEv2/storage/binaries/cdb225c8998e9fbdcf3b1c3910dc5ff22c953f620f160b5cd37ecebf4273a99e
crc32: FA2FEC61
md5: 42f24355c9161314a3547e5bbb874712
sha1: 97533628686a9b0b8265bd43a1320bb528f14701
sha256: cdb225c8998e9fbdcf3b1c3910dc5ff22c953f620f160b5cd37ecebf4273a99e
sha512: 73e8b8c54128c1bde736a7bfb80ed6d0b7049f5cb22b9d1cb614f15a6400cf11cb54a563b00cabe42bc56901ec24a3e124315ab0fdfc5461e9b5cf6077d31729
ssdeep: 24576:Ov3iu12w/PwqZM7u1Vw4a9sAqRDdOAZT:OZwju13jRDJ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13C356C12B791C4B2C215153015BA57BEA9309B673A21DEC7B3D4DEAC6C233D1AE2724F
sha3_384: c9aa2e60ec6a4d1feac99cb981af3935e1f269d7b451a4e101e3089e345b8bc8e587e97a2008445d81ed69a42f1946c0
ep_bytes: 558bec6aff68d8434c00686439490064
timestamp: 2023-11-04 14:26:46

Version Info:
0: [No Data]

Trojan:Win32/Znyonm also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.lwTm
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Babar.60284
FireEye	Generic.mg.42f24355c9161314
Skyhigh	BehavesLike.Win32.Generic.th
ALYac	Gen:Variant.Babar.60284
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Babar.60284
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 005246d51 )
BitDefender	Gen:Variant.Babar.60284
K7GW	Trojan ( 005246d51 )
Cybereason	malicious.8686a9
BitDefenderTheta	Gen:NN.ZexaF.36792.grW@a8aCxLob
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
Kaspersky	UDS:Trojan.Win64.Agentb.bgp
Alibaba	Trojan:Win32/Genric.a2b03a68
NANO-Antivirus	Trojan.Win32.FlyStudio.kdedrd
Sophos	Generic Reputation PUA (PUA)
DrWeb	Trojan.Siggen7.35352
TrendMicro	TROJ_GEN.R011C0PK623
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Babar.60284 (B)
Ikarus	Trojan.Win32.Agent
MAX	malware (ai score=86)
GData	Win32.Trojan.PSE.15EXSUN
Google	Detected
Varist	W32/Trojan.CLL.gen!Eldorado
Antiy-AVL	Trojan/Win32.FlyStudio.a
Kingsoft	malware.kb.a.953
Xcitium	Worm.Win32.Dropper.RA@1qraug
Arcabit	Trojan.Babar.DEB7C
ZoneAlarm	UDS:Trojan.Win64.Agentb.bgp
Microsoft	Trojan:Win32/Znyonm
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Generic.C5538197
McAfee	GenericRXET-MT!42F24355C916
DeepInstinct	MALICIOUS
VBA32	Adware.Presenoker
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R011C0PK623
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CoinMiner.PHP!tr
AVG	Win64:Malware-gen
Avast	Win64:Malware-gen
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Trojan:Win32/Znyonm?

Trojan:Win32/Znyonm removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X