Win64/Rozena.LV information

The Win64/Rozena.LV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win64/Rozena.LV virus can do?

Possible date expiration check, exits too soon after checking local time
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win64/Rozena.LV?


File Info:
name: AC7C05AB4D9DE99F5976.mlw
path: /opt/CAPEv2/storage/binaries/2569cc660d2ae0102aa74c98d78bb9409ded24101a0eeec15af29d59917265f3
crc32: D95DCF72
md5: ac7c05ab4d9de99f597643d219a90d04
sha1: 08f22c5fc0046af092c04917dddab5c2dc758767
sha256: 2569cc660d2ae0102aa74c98d78bb9409ded24101a0eeec15af29d59917265f3
sha512: 141117d47cb198398ae8c481396af4b162f2ea6037c30bcb83c758b758c9d527a4d9ed9a9e08b5127dd618358fe578fd079bd0251c57c48c8ef1f36491d01aa8
ssdeep: 768:FkJj9lP8drOpng0s+1BNc/wTF8/DizSgWO9bD:FKj8v0s+1Lc/wh8/DiziID
type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
tlsh: T1B33396D47AE49CDBEE24823C01F7C232267DBAD147534B53AA30A5350F12BE53AE5786
sha3_384: 117da509896b2165c8503adeaf1df05b0b61afcc7916ebbdefd2041f4d8ea80224d8c04dc895d64f36db2c761091ede2
ep_bytes: 4883ec48488b05b5360000c700000000
timestamp: 2021-09-01 22:07:58

Version Info:
0: [No Data]

Win64/Rozena.LV also known as:

Lionic	Trojan.Win32.Bulz.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
McAfee	RDN/Generic.dx
Malwarebytes	Trojan.ShellCode
Sangfor	Trojan.Win64.Shelma.nii
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win64/Shelma.40313590
K7GW	Trojan ( 00581ccb1 )
K7AntiVirus	Trojan ( 00581ccb1 )
Cyren	W64/Trojan.EQCZ-6796
ESET-NOD32	Win64/Rozena.LV
Paloalto	generic.ml
Kaspersky	Trojan.Win64.Shelma.nii
BitDefender	Gen:Variant.Bulz.391590
NANO-Antivirus	Trojan.Win64.Rozena.izzucc
MicroWorld-eScan	Gen:Variant.Bulz.391590
Avast	Win32:CVE-2021-26084-A [Expl]
Tencent	Win64.Trojan.Shelma.Lors
Ad-Aware	Gen:Variant.Bulz.391590
Sophos	Mal/Generic-R + Troj/Agent-BHRQ
DrWeb	Trojan.Siggen15.6651
TrendMicro	Trojan.Win64.TINYOMED.ZYII
McAfee-GW-Edition	RDN/Generic.dx
FireEye	Gen:Variant.Bulz.391590
Emsisoft	Gen:Variant.Bulz.391590 (B)
Ikarus	Trojan.Win64.Rozena
GData	Gen:Variant.Bulz.391590
Jiangmin	Trojan.Shelma.jmb
Avira	TR/Rozena.ncspn
Kingsoft	Win32.Troj.Win64.n.(kcloud)
Gridinsoft	Trojan.Win64.Downloader.vb
Arcabit	Trojan.Bulz.D5F9A6
ZoneAlarm	Trojan.Win64.Shelma.nii
Microsoft	Trojan:Win32/Casdet!rfn
AhnLab-V3	Malware/Win64.Generic.C4244522
VBA32	Trojan.Win64.Shelma
ALYac	Trojan.Shelma.gen
MAX	malware (ai score=87)
Cylance	Unsafe
TrendMicro-HouseCall	Trojan.Win64.TINYOMED.ZYII
Yandex	Trojan.Shelma!emVB8+Q99fs
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W64/Shelma.LV!tr
Webroot	W32.Trojan.Gen
AVG	Win32:CVE-2021-26084-A [Expl]
Panda	Trj/CI.A

How to remove Win64/Rozena.LV?

Win64/Rozena.LV removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X