Win32/Rozena.ANU removal

The Win32/Rozena.ANU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Rozena.ANU virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Attempts to connect to a dead IP:Port (1 unique times)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/Rozena.ANU?


File Info:
name: 13AA8934BAD18B033A40.mlw
path: /opt/CAPEv2/storage/binaries/df78a6fb54e5709f57dbfe3a717c1bf6584a867c564acd916368528e0a775c13
crc32: 818F24A2
md5: 13aa8934bad18b033a4080a2760c2c48
sha1: bbe4a483490a63dfe81993d92507036e62294b73
sha256: df78a6fb54e5709f57dbfe3a717c1bf6584a867c564acd916368528e0a775c13
sha512: 0ba91d9bfb73c4d5506da551190bc836fcd356a496b6650afd2a063e5e6f0240f22f1ee206cc74ea16df477dff44c08204ecf603795d0e00c01d0ef0db4a8ca5
ssdeep: 1536:Vw5iTNNkcdYcy0WOrru3yUyJCb8V0U7GawC:VBbkcZy01W1A
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T192A309D7FA8AEDA3F925173989F58319133DE7C00B828B171D21993A0B175E1BFC524A
sha3_384: a277c7c764694545e1daa1969cd6083127976266d999c4bb8f12534e47f8dd13536932808157cfe75faabc8f761ec465
ep_bytes: 83ec0cc7053450400000000000e84e0a
timestamp: 2022-01-31 10:18:47

Version Info:
0: [No Data]

Win32/Rozena.ANU also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Corrempa.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.38835312
ALYac	Trojan.GenericKD.38835312
Cylance	Unsafe
Sangfor	Trojan.Win32.Corrempa.gen
K7AntiVirus	Trojan ( 0057365f1 )
Alibaba	Trojan:Win32/Corrempa.c3e39c74
K7GW	Trojan ( 0057365f1 )
CrowdStrike	win/malicious_confidence_60% (W)
ESET-NOD32	a variant of Win32/Rozena.ANU
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Corrempa.gen
BitDefender	Trojan.GenericKD.38835312
Avast	Win32:Trojan-gen
Rising	Trojan.Rozena!8.6D (CLOUD)
Sophos	Mal/Generic-S
Zillya	Trojan.Rozena.Win32.135640
Emsisoft	Trojan.GenericKD.38835312 (B)
SentinelOne	Static AI – Suspicious PE
Avira	TR/Crypt.ZPACK.Gen7
MAX	malware (ai score=84)
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4952835
McAfee	Artemis!13AA8934BAD1
Malwarebytes	Trojan.ShellCode
Yandex	Trojan.GenAsa!47+2WuzTxag
Ikarus	Trojan.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Rozena.ANU!tr
AVG	Win32:Trojan-gen

How to remove Win32/Rozena.ANU?

Win32/Rozena.ANU removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X