Trojan-GameThief.Win32.Magania removal tips

The Trojan-GameThief.Win32.Magania is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-GameThief.Win32.Magania virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Deletes its original binary from disk
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Creates a copy of itself

How to determine Trojan-GameThief.Win32.Magania?

File Info:
name: 80F7DE2EF50ACC363428.mlw
path: /opt/CAPEv2/storage/binaries/f2607a3e39ca692ae908dd75fdf386fa60aa7965e55d415508a790e92f378809
crc32: 9F993B9F
md5: 80f7de2ef50acc3634288bc40d41e4c3
sha1: 7830eb5b7c7af0cc90f977f4f745f567e318e0cc
sha256: f2607a3e39ca692ae908dd75fdf386fa60aa7965e55d415508a790e92f378809
sha512: 0a045f617fc9ccb418a719e146edfd71d32e534fb324534e2c6e18a47bfff52a5a6660d05fce4b3fbf40e8cc758b1bc214b8456d9e7b8edfc828d45dcb6e51e3
ssdeep: 49152:IaHrmDSbN6BPPhgryjUMaxCfQvNII0Thxw:3KDSbN6BPPJDaxHF0U
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C4C5AE13F651C0B2D11C263115FB6739BA349F261A61CE93D7A4EEB96C32361A72730E
sha3_384: 596083617e92ab802ae3b9bf5a926cfcfa8aa9282b2c69e7401e2d59eae122f8d92d496f07b91bceb3a201b8bd8073e3
ep_bytes: 558bec6aff68b03e660068e83d4a0064
timestamp: 2021-11-18 11:28:35

Version Info:
FileVersion: 1.1.5.3
FileDescription: explorer.exe
ProductName: explorer.exe
ProductVersion: 1.1.5.3
CompanyName: explorer.exe
LegalCopyright: 免责声明：
本程序是辅助程序 只供学习和研究使用 请不要拿本程序去游戏中高调和宣传，
为了防止本程序泛滥使用，影响游戏的不和谐不公平，请24小时内删除本软件，
切忌严禁在游戏中使用!
本程序的使用和购买，全是您的自愿行为，一切违法犯罪行为与本程序无关，
谢谢配合。最后请大家自觉维护游戏平衡！
Comments: explorer.exe
Translation: 0x0804 0x04b0

Trojan-GameThief.Win32.Magania also known as:

How to remove Trojan-GameThief.Win32.Magania?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.