How to remove “Mimikatz.Spyware.Stealer.DDS”?

The Mimikatz.Spyware.Stealer.DDS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Mimikatz.Spyware.Stealer.DDS virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Executed a sysinternals tool
CAPE detected the mimikatz malware family
PSExec was executed

How to determine Mimikatz.Spyware.Stealer.DDS?


File Info:
name: B4179BD923CFC7D4F356.mlw
path: /opt/CAPEv2/storage/binaries/2ead5b90a07965923ed5004f70426e6148f1614587382e66884c1dc0eccf8fb1
crc32: CDD98856
md5: b4179bd923cfc7d4f35646873b983fa7
sha1: bfbd4095d7407c428e8ab2c3e6bcdbe7b1d6ab00
sha256: 2ead5b90a07965923ed5004f70426e6148f1614587382e66884c1dc0eccf8fb1
sha512: a9c05ece2edb065481ab7aa27537a9c218da8aa68f92c46c492909c3d15f3aba25bdc389ab16f9c81ac0d94219ddc0ec09ee0c0e4187a5c401a87ff22c60f967
ssdeep: 24576:UcX7O5FulOcsV9DK2J2aBcpsam5RvikgR:Ji5FulOcQMYYsP5RviPR
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1C4453A11B3E900A4F5B75AB19EF59522DBB778E61930C30F1298864E2F73B909D39732
sha3_384: 8bd15e47f2eda7130a1eba5ca612cc0c5975f29f22a8dc7a0cefc18577ec45bccb9d7b76d0c2fd0091da0076e95f163f
ep_bytes: e815770000e97bfeffff558bec81ec28
timestamp: 2016-06-28 18:43:09

Version Info:
CompanyName: Sysinternals - www.sysinternals.com
FileDescription: Execute processes remotely
FileVersion: 2.2
InternalName: PsExec
LegalCopyright: Copyright (C) 2001-2016 Mark Russinovich
OriginalFilename: psexec.c
ProductName: Sysinternals PsExec
ProductVersion: 2.2
Translation: 0x0409 0x04b0

Mimikatz.Spyware.Stealer.DDS also known as:

Elastic	Windows.Hacktool.Mimikatz
MicroWorld-eScan	Application.Agent.GVJ
FireEye	Application.Agent.GVJ
ALYac	Application.Agent.GVJ
Malwarebytes	Mimikatz.Spyware.Stealer.DDS
Cybereason	malicious.923cfc
APEX	Malicious
BitDefender	Application.Agent.GVJ
Rising	HackTool.Mimikatz!1.B3A8 (CLASSIC)
VIPRE	Application.Agent.GVJ
Emsisoft	Application.Agent.GVJ (B)
GData	Application.Agent.GVJ
MAX	malware (ai score=70)
Antiy-AVL	HackTool/Win64.Mimikatz.a
Arcabit	Application.Agent.GVJ
Google	Detected
MaxSecure	Trojan.Malware.121218.susgen
DeepInstinct	MALICIOUS

How to remove Mimikatz.Spyware.Stealer.DDS?

Mimikatz.Spyware.Stealer.DDS removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X