Categories: Malware

Strictor.265602 removal

The Strictor.265602 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Strictor.265602 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Network activity detected but not expressed in API logs
Binary compilation timestomping detected

Related domains:

wpad.local-net

How to determine Strictor.265602?


File Info:
name: E65B1A4CD350283B7D02.mlwpath: /opt/CAPEv2/storage/binaries/9d5b3db92ec58afc5cb919f435b779a8758c6d7b8e364f478aded059f42737d5crc32: DC89DF82md5: e65b1a4cd350283b7d028b8be9cfd1edsha1: 004095a1351eb02a772d10a637750916ac84ddcbsha256: 9d5b3db92ec58afc5cb919f435b779a8758c6d7b8e364f478aded059f42737d5sha512: a65b2fcda182dd1fe77adce6a2bb4b3ea86caa15088f61ebf0e0fbf8c520a39b61cfe95433c455df748696d4d5a3643562b72d5b36e60f36c2568a30997acf32ssdeep: 768:JYpp5dHMLJDFex/OXoXAfnuqzYsk8ub3:JYppgsOXoXAmqF0type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T13DB3F8157AA5CA18C0AD4E394CA3D5780B72EE269C31870BB6C0FF5F7EB53915A21370sha3_384: 8327bf55fa44dc2494edf2e34115f10d91edbe2b5b49a488334b93014e69b4649d9e7568f5781161554389ab28a8e4e5ep_bytes: ff250020400000000000000000000000timestamp: 2089-08-14 02:33:43
Version Info:
Translation: 0x0000 0x04b0Comments: CompanyName: FileDescription: Windows AssistanceFileVersion: 1.0.0.0InternalName: Windows Assistance.exeLegalCopyright: Copyright ©  2021LegalTrademarks: OriginalFilename: Windows Assistance.exeProductName: Windows AssistanceProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

Strictor.265602 also known as:

Lionic	Trojan.MSIL.Disco.i!c
MicroWorld-eScan	Gen:Variant.Strictor.265602
FireEye	Gen:Variant.Strictor.265602
ALYac	Gen:Variant.Strictor.265602
Cylance	Unsafe
K7AntiVirus	Password-Stealer ( 0058a9081 )
Alibaba	TrojanPSW:MSIL/Disco.717b15b1
K7GW	Password-Stealer ( 0058a9081 )
Cybereason	malicious.1351eb
Arcabit	Trojan.Strictor.D40D82
BitDefenderTheta	Gen:NN.ZemsilCO.34294.gm0@aW4sxgl
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/PSW.Agent.SOM
TrendMicro-HouseCall	TROJ_GEN.R002C0WKI21
Kaspersky	HEUR:Trojan-PSW.MSIL.Disco.gen
BitDefender	Gen:Variant.Strictor.265602
Avast	Win32:Trojan-gen
Ad-Aware	Gen:Variant.Strictor.265602
TrendMicro	TROJ_GEN.R002C0WKI21
McAfee-GW-Edition	Artemis
SentinelOne	Static AI – Suspicious PE
Emsisoft	Gen:Variant.Strictor.265602 (B)
APEX	Malicious
Avira	TR/PSW.Agent.byibm
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Strictor.265602
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.PWS.C4784303
McAfee	Artemis!E65B1A4CD350
MAX	malware (ai score=85)
Malwarebytes	Spyware.PasswordStealer.MSIL
Yandex	Trojan.PWS.Agent!8ObicAwncD0
Ikarus	Trojan.MSIL.PSW
Fortinet	MSIL/Agent.SOM!tr.pws
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_60% (W)