What is “Win32/TrojanDownloader.Fosniw.AU”?

The Win32/TrojanDownloader.Fosniw.AU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Fosniw.AU virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Checks adapter addresses which can be used to detect virtual network interfaces
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Unconventionial language used in binary resources: Korean
• The binary contains an unknown PE section name indicative of packing
• The executable is compressed using UPX
• Authenticode signature is invalid
• Deletes its original binary from disk
• Installs itself for autorun at Windows startup
• Attempts to modify proxy settings
• Harvests cookies for information gathering

How to determine Win32/TrojanDownloader.Fosniw.AU?

File Info:
name: 280F310A52F10F6F1829.mlw
path: /opt/CAPEv2/storage/binaries/bfc9e85ce664f237ab34e714c3880442c921f16c53a94902371ad5a517bbd2a9
crc32: 320B8929
md5: 280f310a52f10f6f1829d4aaf74dad6f
sha1: e61924aefd3a0443ea1c7610199a206f6152e3f5
sha256: bfc9e85ce664f237ab34e714c3880442c921f16c53a94902371ad5a517bbd2a9
sha512: 4e7967c5613c16cb9c61cfc541ad15224b169c05229749ab8ec8b7c561e32b228b5793d0c67345417b91f7b86fe952212bd2a7c45adc9bf96859e0f06105a2b1
ssdeep: 6144:2retST8MNCNYtqzJAzFiodePlwjcoShge:VtSwMNCNuqWbdeecoSSe
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T109445A20B542C477E8A7007689FDD67AA518FE710B7450C3B7C86BAE9F3A6E22D34147
sha3_384: 111a842d0f73880d395f8ab6e8d0a4c2c82478ba1b17b686bbd3fcf2bca5f0a92797657fb48c3b40b21dd99d99f452f6
ep_bytes: e8e56f0000e978feffffcc68e0894100
timestamp: 2010-12-21 00:31:59

Version Info:
CompanyName: TODO: 
FileDescription: TODO: 
FileVersion: 1.0.0.1
LegalCopyright: TODO: (c) .  All rights reserved.
InternalName: IEKeyword_EXE.exe
OriginalFilename: IEKeyword_EXE.exe
ProductName: TODO: 
ProductVersion: 1.0.0.1
Translation: 0x0412 0x03b5

Win32/TrojanDownloader.Fosniw.AU also known as:

How to remove Win32/TrojanDownloader.Fosniw.AU?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.