Spyware.GinzoStealer removal instruction

The Spyware.GinzoStealer is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Spyware.GinzoStealer virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Spyware.GinzoStealer?


File Info:
name: 3054525BF5D910BAA782.mlw
path: /opt/CAPEv2/storage/binaries/c0b257faeda4ded8ee8bedc26d3cdc49ca376a9c813e295b07462e4e0ee06527
crc32: F80D9C7C
md5: 3054525bf5d910baa782d368312741dc
sha1: 5ebaa9e31146a024ced1549421b9788289cdabb8
sha256: c0b257faeda4ded8ee8bedc26d3cdc49ca376a9c813e295b07462e4e0ee06527
sha512: 794c57e441e8e6c2b092d309ff6a65aacd9abc5af73e57f81719c861e9ebd4822b42f58aab069445f5d070a076d82cc15bb3aac47965084b7e9d63fe5920b158
ssdeep: 768:1HFmzwHa15z5LwpLhm1Z+NSuH1ySKqRLkrdXGXbR232I0OSF0Ory/hUpw4USiHHP:Eug5V9huH1oqRIrdWkW9ry/hUpwiiHv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BDA3499C766072EFC867D472DEA81C78EB6034BB531B4213A42716AD9E4D89BDF140F2
sha3_384: 0aac2103b0b3aca49b7057ce991dbd84088183904704e324bc295bb96d6ac892a2ebd143ee38a3919baacbcdfe67991e
ep_bytes: ff250020400000000000000000000000
timestamp: 2060-10-13 00:01:01

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: Ginzo.exe
LegalCopyright: Copyright © 2022
LegalTrademarks: 
OriginalFilename: Ginzo.exe
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Spyware.GinzoStealer also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.39370027
ALYac	Trojan.GenericKD.39370027
Cylance	Unsafe
Sangfor	Trojan.Win32.Sabsik.FL
K7AntiVirus	Trojan ( 0058bc5f1 )
Alibaba	Packed:MSIL/MindLated.e063d36c
K7GW	Trojan ( 0058bc5f1 )
BitDefenderTheta	Gen:NN.ZemsilF.34638.fm0@auSwLCk
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of MSIL/Packed.MindLated.D.gen suspicious
APEX	Malicious
BitDefender	Trojan.GenericKD.39370027
Ad-Aware	Trojan.GenericKD.39370027
F-Secure	Heuristic.HEUR/AGEN.1234898
Zillya	Trojan.MindLated.Win32.131
McAfee-GW-Edition	BehavesLike.Win32.Generic.nm
FireEye	Generic.mg.3054525bf5d910ba
Emsisoft	Trojan.GenericKD.39370027 (B)
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKD.39370027
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1234898
MAX	malware (ai score=81)
Arcabit	Trojan.Generic.D258BD2B
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!3054525BF5D9
Malwarebytes	Spyware.GinzoStealer
TrendMicro-HouseCall	TROJ_GEN.R002H09CV22
Rising	Trojan.Generic@AI.95 (RDMK:cmRtazoTHLWncArjVn2MZSVgGJkQ)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/Application
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Spyware.GinzoStealer?

Spyware.GinzoStealer removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X