Win32/Rozena.BHY information

The Win32/Rozena.BHY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Rozena.BHY virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
At least one process apparently crashed during execution
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/Rozena.BHY?


File Info:
name: 8E70C485F5D1887E6EC7.mlw
path: /opt/CAPEv2/storage/binaries/c829b478aec0dac8df23dca81584f14bb6db0e364edc4a4357c7e1f948a9cc45
crc32: A1C621DC
md5: 8e70c485f5d1887e6ec73cd337222c8b
sha1: 542b08791115d485229f872222c0e01c50f326c1
sha256: c829b478aec0dac8df23dca81584f14bb6db0e364edc4a4357c7e1f948a9cc45
sha512: f2e01b14bee2ece3c41091581f79b3eed4c1b7c039383b79f3139957b3acdd804f39ee38c5cc7d11ad6b07597e04c7e6efda0123da64ddf25507957db6b25220
ssdeep: 384:r9gpmEEKOVej1I4GS1de7B6uOGRBaxI+VbPeuaBU3losjuzZ6UwYRGZqO7QbC+9A:ImEEsb40GuVPP3lLuzZPKqvAqp4d
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T179132B99BE258CF7EA52533E90E7C7762B3DF1814A2347B3B730BB345B136912099246
sha3_384: 785cbc74a4aa04235a9811d471d653ae09a717cefecdfd0d06da2c314175be79ca2073d97fc391ca88c6c4f8625c47d1
ep_bytes: 83ec1cc7042401000000ff158c814000
timestamp: 2022-01-17 23:47:22

Version Info:
0: [No Data]

Win32/Rozena.BHY also known as:

Bkav	W32.AIDetect.malware2
MicroWorld-eScan	Trojan.GenericKD.48155893
FireEye	Generic.mg.8e70c485f5d1887e
ALYac	Trojan.GenericKD.48155893
Malwarebytes	Trojan.Meterpreter
Sangfor	Trojan.Win32.GenericKD.48155893
K7GW	Trojan ( 0058d87f1 )
K7AntiVirus	Trojan ( 0058d87f1 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Rozena.BHY
TrendMicro-HouseCall	TROJ_GEN.R002H0CAV22
BitDefender	Trojan.GenericKD.48155893
APEX	Malicious
Rising	Trojan.Rozena!8.6D (CLOUD)
Emsisoft	Trojan.GenericKD.48155893 (B)
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Win32.Rozena
MAX	malware (ai score=82)
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Program:Win32/Wacapew.C!ml
GData	Trojan.GenericKD.48155893
Cynet	Malicious (score: 100)
McAfee	RDN/Generic.rp
Avast	Win32:Trojan-gen
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Rozena.BHY!tr
AVG	Win32:Trojan-gen

How to remove Win32/Rozena.BHY?

Win32/Rozena.BHY removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X