Android/Spy.SmsSpy.IT (file analysis)

The Android/Spy.SmsSpy.IT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Android/Spy.SmsSpy.IT virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid

How to determine Android/Spy.SmsSpy.IT?

File Info:
name: 0A0485A7B0BA98E741BD.mlw
path: /opt/CAPEv2/storage/binaries/aa22fc3a09c5d740e72dd1032f54f3d347f5feebd09b6acaedde293dc32a0974
crc32: 55197B7B
md5: 0a0485a7b0ba98e741bd91c10cbec993
sha1: e4ab6eee0854f67d98c19030b93e885f3246ecbc
sha256: aa22fc3a09c5d740e72dd1032f54f3d347f5feebd09b6acaedde293dc32a0974
sha512: 7c504ee12a1f6334f31fff031415da5425e2230f0717ac5878c68743508f9b9d8b684ed69df25a683d3fc2a8442b2d9b794565d52c2b85efa9978c42db9961a8
ssdeep: 98304:cbn4EyMSEggTCaSmaN/7gP+mPGeUO6H2iThDzxDYflTK23G4cZuDBjMewdtGB2S1:O6ySj/mxQWMhnxMl2iGv4BudoUS8o
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DE56337FA13802B8C5A14776F2634450E93B5C537B30698F9BA80C9AFE7BDFD911490A
sha3_384: fb748d2d1c9d0d7cc3504f2eb993cebc16270e355cc53f24fc613c37248ba4aa7eab8815d9e2a11b2f058115ef57f89d
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: 此安装程序由 Inno Setup 构建。
CompanyName: 求索软件                                                        
FileDescription: 求索人事档案管理系统 Setup                                            
FileVersion:                     
LegalCopyright:                                                                                                     
ProductName: 求索人事档案管理系统                                                  
ProductVersion:                     
Translation: 0x0804 0x0000

Android/Spy.SmsSpy.IT also known as:

How to remove Android/Spy.SmsSpy.IT?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.