Python/Spy.KeyLogger.SK (file analysis)

The Python/Spy.KeyLogger.SK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Python/Spy.KeyLogger.SK virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Created a process from a suspicious location
• CAPE detected the PyInstaller malware family

How to determine Python/Spy.KeyLogger.SK?

File Info:
name: C86C2A545602E562C3D6.mlw
path: /opt/CAPEv2/storage/binaries/b3743c833633484a03e8dbfafd81169939830337e5f2ed0bc880a4843edeabea
crc32: 1D7BF2C1
md5: c86c2a545602e562c3d61cd68b2d8224
sha1: 99b8000e90a322843459e813bfd9827400960883
sha256: b3743c833633484a03e8dbfafd81169939830337e5f2ed0bc880a4843edeabea
sha512: 4dc9e07e9696a2bd9d007c072d9d27da1eecb418397e9a9df034145dc3c5d57a15df03f9d32a5138538925ab2be9ce5e84f4e9df293224dadd4c1fe01cd6b7d6
ssdeep: 98304:ULqRAALKTDbdRGQSxUTZeNEiIK176nz1p/kpkGzMJfhRWKVmOOw3ILTol:8qm7TDp4QeUpg176z1p/k/zMtPW0Sbo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17B563369C8560570F36288B1C767FE56AD0EBD82CF23682BC7153B3658339DD169382B
sha3_384: 9f3efe720abb148cf2b7b2db6e24fa54eff4237751fedf5a3bda693f222274a82870d7287824362141839af1179fe764
ep_bytes: 60be002043008dbe00f0fcff57eb0b90
timestamp: 2021-08-01 04:40:34

Version Info:
0: [No Data]

Python/Spy.KeyLogger.SK also known as:

How to remove Python/Spy.KeyLogger.SK?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.