Malware

About “WinGo/Rozena.CZ” infection

Malware Removal

The WinGo/Rozena.CZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What WinGo/Rozena.CZ virus can do?

  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid

How to determine WinGo/Rozena.CZ?


File Info:

name: 178CA7960BCC77EAAA7C.mlw
path: /opt/CAPEv2/storage/binaries/955f4c16d7d283e363860701d52d98402d463aedcb089f8cdf4819be31a23e21
crc32: 90023B1E
md5: 178ca7960bcc77eaaa7ca402255130d7
sha1: bf4c789cafdb0526632fe699f402bf08ae273eb1
sha256: 955f4c16d7d283e363860701d52d98402d463aedcb089f8cdf4819be31a23e21
sha512: e6586392fa69139947ca6b23ecd16ecf1f2b91c3e9c55665c191cd8021c4f43e32df33eb12ce1f2031c203edfe25841b96f1dd60755b5f2ad51710de5de9124d
ssdeep: 49152:E2cxjudd0TGWGv5I1/rZndvp/DU141hrqxFpyJKpq5xYbL:oTbr5j2LUJKpq5
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T186E55B16B8D254FAC9BAF2308566936276727C6983303BD71E84A63E1F35BD42E3D314
sha3_384: 350be73d2c0209a37cdf9b0e557d22ce869fa0d0750fcda29f564660eddd0912a0fdc89c6ec42048010a58c93568da60
ep_bytes: e93bc2ffffcccccccccccccccccccccc
timestamp: 1970-01-01 00:00:00

Version Info:

0: [No Data]

WinGo/Rozena.CZ also known as:

LionicTrojan.Win64.Alien.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.76500
FireEyeTrojan.GenericKDZ.76500
ALYacTrojan.GenericKDZ.76500
ZillyaTrojan.Alien.Win64.112
SangforTrojan.Win64.Alien.qn
K7AntiVirusTrojan ( 005804e01 )
AlibabaTrojan:Win64/Alien.f5542356
K7GWTrojan ( 005804e01 )
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of WinGo/Rozena.CZ
TrendMicro-HouseCallTROJ_GEN.R002C0WH521
KasperskyTrojan.Win64.Alien.qn
BitDefenderTrojan.GenericKDZ.76500
AvastWin64:Trojan-gen
TencentWin64.Trojan.Alien.Dyqu
Ad-AwareTrojan.GenericKDZ.76500
EmsisoftTrojan.GenericKDZ.76500 (B)
DrWebExploit.ShellCode.26
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R002C0WH521
McAfee-GW-EditionBehavesLike.Win64.Generic.wh
SophosMal/Generic-S
APEXMalicious
JiangminTrojan.Alien.nt
AviraTR/Redcap.uoeka
MAXmalware (ai score=87)
MicrosoftTrojan:Win32/Wacatac.B!ml
GDataTrojan.GenericKDZ.76500
CynetMalicious (score: 100)
McAfeeArtemis!178CA7960BCC
VBA32Trojan.Win64.Alien
MalwarebytesMalware.AI.3040317607
IkarusTrojan.WinGo.Rozena
YandexTrojan.Alien!M5xlViLyLFI
FortinetW32/Rozena.CZ!tr
AVGWin64:Trojan-gen
PandaTrj/CI.A

How to remove WinGo/Rozena.CZ?

WinGo/Rozena.CZ removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment