Trojan:Win32/Znyonm removal

The Trojan:Win32/Znyonm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Znyonm virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Created a service that was not started
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Znyonm?

File Info:
name: D27ECC00ED2CA3622E1C.mlw
path: /opt/CAPEv2/storage/binaries/8d434728fad2c432c754e2caf9bfd49a5aa0a20320dd7ceb8cc949d8fbd4f785
crc32: 6404F641
md5: d27ecc00ed2ca3622e1c5c6cec777e8b
sha1: 418e331b4920682197819fa667e89681581da179
sha256: 8d434728fad2c432c754e2caf9bfd49a5aa0a20320dd7ceb8cc949d8fbd4f785
sha512: 14c9231fee833739f157bf2e63c82d53a2d847eeb968419a7fa2c62707e4d2810eb7572c20908737d9aa2ee6377cc6baebd2f816f6732f218fa4954eeae5d0f8
ssdeep: 98304:btQha0MkVt+t+4gy3/2E12nPwscUWnwPawLrpC3lyB3dlE:Sha0MkVt+JtP2DYscnwPRrpLu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T181F5334377009A31C1B99C7C8DB6EE2D4BB7B7164B3A6429346C2E4E8F6BE81741E513
sha3_384: 3eb852d1600231f6e21c8834706fecc12be0271cdc81799dd5b2772c5b6a5cd278d064e9571d2706ec9af07e83868ece
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 2023-11-28 17:03:32

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: MPEG4Binder Setup                                           
FileVersion:                     
LegalCopyright:                                                                                                     
ProductName: MPEG4Binder                                                 
ProductVersion:                     
Translation: 0x0000 0x04b0

Trojan:Win32/Znyonm also known as:

How to remove Trojan:Win32/Znyonm?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.