Win32/TrojanDownloader.Small.BHZ removal guide

The Win32/TrojanDownloader.Small.BHZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Small.BHZ virus can do?

Injection with CreateRemoteThread in a remote process
Attempts to connect to a dead IP:Port (1 unique times)
Possible date expiration check, exits too soon after checking local time
A process attempted to delay the analysis task.
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
A process created a hidden window
Drops a binary and executes it
Performs some HTTP requests
Unconventionial language used in binary resources: Korean
Uses Windows utilities for basic functionality
Code injection with CreateRemoteThread in a remote process
Deletes its original binary from disk
A system process is generating network traffic likely as a result of process injection
Creates a hidden or system file
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

www.56561234.com

a.tomx.xyz

How to determine Win32/TrojanDownloader.Small.BHZ?


File Info:
crc32: D44B58AD
md5: d2ba88d950016db0b618414170c79a17
name: D2BA88D950016DB0B618414170C79A17.mlw
sha1: 25ac521be28432a863038b4ea94b326277ef6d7b
sha256: ea331d5ee63aefb17e5f2e0b1706a1c4b316beb885c4ce74caf51a4209ddbb04
sha512: 6e138725a082ab3d234092a8bee7966abb8c2897f9d87c4d5de1e0d5e8085516c3c4a90bf05277094547f02379ab2ade562f6e0fb4713cf2077d3c0a996613de
ssdeep: 192:oZZ0cAMxXSN6J78m9pePAOtQt6RPkl+K/jjJJ1VqaFGs:objStPAOtQgRkMgjj5dks
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2017
ProductVersion: 1, 0, 0, 1
ProductName: xc751xc6a9 xd504xb85cxadf8xb7a8
FileVersion: 1, 0, 0, 1
FileDescription: xc751xc6a9 xd504xb85cxadf8xb7a8
Translation: 0x0409 0x04b0

Win32/TrojanDownloader.Small.BHZ also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Cylance	Unsafe
Cybereason	malicious.be2843
Cyren	W32/Bloop.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Small.BHZ
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan-GameThief.Win32.Latot.gen
BitDefenderTheta	Gen:NN.ZexaF.34170.aq0@aS7WpKmO
FireEye	Generic.mg.d2ba88d950016db0
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1141417
Microsoft	Trojan:Win32/Tnega!ml
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Generic
VBA32	BScope.Trojan.Wacatac
Ikarus	Trojan-Downloader.Win32.Small
Fortinet	W32/Small.BHZ!tr
AVG	Win32:TrojanX-gen [Trj]

How to remove Win32/TrojanDownloader.Small.BHZ?

Win32/TrojanDownloader.Small.BHZ removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/TrojanDownloader.Small.BHZ removal guide