Trojan-GameThief.Win32.Latot.ddu (file analysis)

The Trojan-GameThief.Win32.Latot.ddu is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-GameThief.Win32.Latot.ddu virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Enumerates running processes
• Expresses interest in specific running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Korean
• Authenticode signature is invalid
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process

How to determine Trojan-GameThief.Win32.Latot.ddu?

File Info:
name: F2FD9E57CF8A0FE941B0.mlw
path: /opt/CAPEv2/storage/binaries/27418e4290f41bd63963a0e491b4b4c121e700adc29f1402e990688748de3d47
crc32: B19E6411
md5: f2fd9e57cf8a0fe941b0f8e565da6499
sha1: 8a226253e2c2876ac8f5581274963fe7f219a544
sha256: 27418e4290f41bd63963a0e491b4b4c121e700adc29f1402e990688748de3d47
sha512: 7f47f4c0f55eca5b740808dc9caf4cf9dfe9080a1f5add60f2823d637b9aa310c7db64cfa95f8abd48c57aa9863eca7f8074ea9cc76fb4ce897c2b49c5a4a1bf
ssdeep: 3072:fvgcIWQEz5n2mlsltR3SZEEHrxcejJv/O89xGQiHn3joVS9Oa:fIcDQEz92n+ZEElcejJ/O8DAo89Oa
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T199049D05AA8380E5EB3DC4B08B731757F9B87C613B952BDFAF2079560F32690D43A51A
sha3_384: 289b40d99e04f44bec514219cd30f2f0064c45ea8fad2679e4239f0d75e0cb55e79a9fb2485e3e2ac357d22493aa15b4
ep_bytes: 4883ec28e8db0300004883c428e986fd
timestamp: 2021-12-08 05:11:51

Version Info:
0: [No Data]

Trojan-GameThief.Win32.Latot.ddu also known as:

How to remove Trojan-GameThief.Win32.Latot.ddu?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.