RiskTool.Win32.FlyStudio.ckga removal tips

The RiskTool.Win32.FlyStudio.ckga is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What RiskTool.Win32.FlyStudio.ckga virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Starts servers listening on 0.0.0.0:19730
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Attempted to write directly to a physical drive

How to determine RiskTool.Win32.FlyStudio.ckga?

File Info:
name: 024DCB311178527C2C55.mlw
path: /opt/CAPEv2/storage/binaries/d4b4b8995d1b927b1623c94a3b1136ca9e751f989948f12a293bc0e1f4b8d285
crc32: 4372883F
md5: 024dcb311178527c2c5583e6f5281e82
sha1: 5dd5b8361d076533dfeb0e8c579ffa686f3bd22b
sha256: d4b4b8995d1b927b1623c94a3b1136ca9e751f989948f12a293bc0e1f4b8d285
sha512: 87a0f6d9a61123e6014157dd15e4bad4511bb4a1547897c0d1a44c0ada227c660a8124be8ee4d01e36d80fdfbb131c0a8b77716d15058ea9c6b3fa872b2dc549
ssdeep: 98304:uhCwdx1SOEkjEBGOFqV6luRnLXlzFZuerv09O2PIb/:KdskQlcV6lYLVBkeD0o2Y/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19F360103F64280F3D104267111B7673A6E349F611E21DBE7EB94FEB49D326A1E62325E
sha3_384: accebc4fd6444638cef09dce384f8f31418998e3b2eb487b1e150427be463f411c3e694f08d542f080a69ae62a1093f2
ep_bytes: 558bec6aff68d0428c00688c22510064
timestamp: 2022-05-24 14:14:01

Version Info:
FileVersion: 1.0.0.0
FileDescription: 易语言程序
ProductName: 易语言程序
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
Translation: 0x0804 0x04b0

RiskTool.Win32.FlyStudio.ckga also known as:

How to remove RiskTool.Win32.FlyStudio.ckga?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.