Should I remove “PWS:MSIL/Stealgen!atmn”?

The PWS:MSIL/Stealgen!atmn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PWS:MSIL/Stealgen!atmn virus can do?

Authenticode signature is invalid
CAPE detected the GloomaneStealer malware family
Binary compilation timestomping detected

How to determine PWS:MSIL/Stealgen!atmn?


File Info:
name: 36647E0B8312EA002AA3.mlw
path: /opt/CAPEv2/storage/binaries/1951fd56f82fca8efe6cf8587290f518d4c3750e8d31780928ecca20c68279b4
crc32: BB68380E
md5: 36647e0b8312ea002aa38c8e187ccd8a
sha1: bd78589a8b998818a099cdf09db46f3793a128b1
sha256: 1951fd56f82fca8efe6cf8587290f518d4c3750e8d31780928ecca20c68279b4
sha512: 1a6ac080f42259c4ff46529bbba0325b349a3496ad93f7c730a57f43101fd2813e7c49c0c177c62b5344eefca7ed9302db66d69975bd39140b8c669f4f842423
ssdeep: 6144:ia6C6MDdbICydeBIeVantpdui98QfwfSuKZiVQ2EA1D0s0Qe:iadTkntpduW8QbuX1DuQe
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11364390467F98B05F1BE9BBDD0B151608371B422A87FEB4E1E85A0EA2D33350DD45BA7
sha3_384: 9bfcf2f5370254d5f9d4c628d1306d9dcadbf914d713ec7df4754ebd428747da7c8898cc6881284bd9aefb16886079fa
ep_bytes: ff250020400050000000050000000100
timestamp: 2095-07-16 14:25:31

Version Info:
Translation: 0x0000 0x04b0
Comments: 44 CALIBER
CompanyName: 44 CALIBER
FileDescription: 44 CALIBER
FileVersion: 1.6.2.0
InternalName: Insidious.exe
LegalCopyright: FuckTheSystem Copyright ©  2021
LegalTrademarks: 
OriginalFilename: Insidious.exe
ProductName: 44 CALIBER
ProductVersion: 1.6.2.0
Assembly Version: 1.6.2.0

PWS:MSIL/Stealgen!atmn also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Stealer.12!c
MicroWorld-eScan	Generic.DataStealer.1.0A448004
ClamAV	Win.Packed.Datastealer-9856291-0
FireEye	Generic.mg.36647e0b8312ea00
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	GenericRXSG-XG!36647E0B8312
Malwarebytes	Trojan.Crypt
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Password-Stealer ( 005282e41 )
Alibaba	TrojanPSW:MSIL/Stealgen.fe19f7cd
K7GW	Password-Stealer ( 005282e41 )
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.GenusT.DMYW
Cyren	W32/MSIL_Troj.ASB.gen!Eldorado
Symantec	Infostealer.Calibous
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/PSW.CoinStealer.CC
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender	Generic.DataStealer.1.0A448004
SUPERAntiSpyware	Trojan.Agent/Gen-DataStealer
Avast	Win32:MalwareX-gen [Trj]
Tencent	Trojan-Spy.Win32.Stealer.16000599
Emsisoft	Trojan-PSW.Agent (A)
F-Secure	Heuristic.HEUR/AGEN.1307065
DrWeb	Trojan.PWS.StealerNET.76
VIPRE	Generic.DataStealer.1.0A448004
TrendMicro	TROJ_GEN.R03BC0DFC23
McAfee-GW-Edition	GenericRXSG-XG!36647E0B8312
Sophos	Troj/Steal-CJF
Ikarus	Trojan.MSIL.PSW
GData	MSIL.Trojan.PSE.11E6O00
Jiangmin	Hoax.DeceptPCClean.acf
Avira	HEUR/AGEN.1307065
Antiy-AVL	Trojan[PSW]/MSIL.CoinStealer
Arcabit	Generic.DataStealer.1.0A448004
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Stealer.gen
Microsoft	PWS:MSIL/Stealgen!atmn
Google	Detected
AhnLab-V3	Infostealer/Win.CALIBER.R513735
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.36250.sm0@auDXb9k
ALYac	Generic.DataStealer.1.0A448004
MAX	malware (ai score=83)
VBA32	Trojan.MSIL.InfoStealer.gen.D
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R03BC0DFC23
Rising	Stealer.Agent!1.D483 (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.74396735.susgen
Fortinet	MSIL/Agent.RML!tr
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove PWS:MSIL/Stealgen!atmn?

PWS:MSIL/Stealgen!atmn removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X