Trojan-GameThief.Win32.Magania removal tips

The Trojan-GameThief.Win32.Magania is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Trojan-GameThief.Win32.Magania virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Deletes its original binary from disk
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Creates a copy of itself

How to determine Trojan-GameThief.Win32.Magania?

File Info:
name: 80F7DE2EF50ACC363428.mlwpath: /opt/CAPEv2/storage/binaries/f2607a3e39ca692ae908dd75fdf386fa60aa7965e55d415508a790e92f378809crc32: 9F993B9Fmd5: 80f7de2ef50acc3634288bc40d41e4c3sha1: 7830eb5b7c7af0cc90f977f4f745f567e318e0ccsha256: f2607a3e39ca692ae908dd75fdf386fa60aa7965e55d415508a790e92f378809sha512: 0a045f617fc9ccb418a719e146edfd71d32e534fb324534e2c6e18a47bfff52a5a6660d05fce4b3fbf40e8cc758b1bc214b8456d9e7b8edfc828d45dcb6e51e3ssdeep: 49152:IaHrmDSbN6BPPhgryjUMaxCfQvNII0Thxw:3KDSbN6BPPJDaxHF0Utype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C4C5AE13F651C0B2D11C263115FB6739BA349F261A61CE93D7A4EEB96C32361A72730Esha3_384: 596083617e92ab802ae3b9bf5a926cfcfa8aa9282b2c69e7401e2d59eae122f8d92d496f07b91bceb3a201b8bd8073e3ep_bytes: 558bec6aff68b03e660068e83d4a0064timestamp: 2021-11-18 11:28:35
Version Info:
FileVersion: 1.1.5.3FileDescription: explorer.exeProductName: explorer.exeProductVersion: 1.1.5.3CompanyName: explorer.exeLegalCopyright: 免责声明：
本程序是辅助程序 只供学习和研究使用 请不要拿本程序去游戏中高调和宣传，
为了防止本程序泛滥使用，影响游戏的不和谐不公平，请24小时内删除本软件，
切忌严禁在游戏中使用!
本程序的使用和购买，全是您的自愿行为，一切违法犯罪行为与本程序无关，
谢谢配合。最后请大家自觉维护游戏平衡！Comments: explorer.exeTranslation: 0x0804 0x04b0

Trojan-GameThief.Win32.Magania also known as:

How to remove Trojan-GameThief.Win32.Magania?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.