About “Trojan-PSW.Win32.Stealer.pzz” infection

The Trojan-PSW.Win32.Stealer.pzz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-PSW.Win32.Stealer.pzz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid

How to determine Trojan-PSW.Win32.Stealer.pzz?

File Info:
name: E4AD85CBA2345AAA71AD.mlw
path: /opt/CAPEv2/storage/binaries/d48e651ef09c330200286e4a32ba98e84128a2053f8a828f4e864831f247b995
crc32: D321F78A
md5: e4ad85cba2345aaa71ad5bd8838ad19e
sha1: d6ef28624b3f2fced4d1debbea0233e0c26efe18
sha256: d48e651ef09c330200286e4a32ba98e84128a2053f8a828f4e864831f247b995
sha512: 1ced1911209c1a7577b7454bd377737ebe158a4c8c51a59ba09902e6cd14870a7340edc7b1805bdff280408bc020d5726c766207d451a24fbe18651fc55c7c0e
ssdeep: 98304:7Siv5RKc+J+m5O59c/pguC7wn2YuEO20SH1dCcN9fx996/E3k6wg/YT4:L58fFOfogl7wn2XE+SVdCMfx9w/aNYU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12366223FB268B13EC4AB0B3205B3D260597BBA64B85B8C2F47F0494DDF664701E3A655
sha3_384: f6ce2cd2d295bb16f005b9f1554d70867ecbf09646e572ca57a704cfd159613f5073d7939182be5708dd3f6810fc8e3c
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2021-06-03 08:09:11

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: Megalink                                                    
FileDescription: Megalink Setup                                              
FileVersion:                     
LegalCopyright:                                                                                                     
OriginalFileName:                                                   
ProductName: Megalink                                                    
ProductVersion:                                                   
Translation: 0x0000 0x04b0

Trojan-PSW.Win32.Stealer.pzz also known as:

How to remove Trojan-PSW.Win32.Stealer.pzz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.