About “Trojan-PSW.Win32.Stealer.wsz” infection

The Trojan-PSW.Win32.Stealer.wsz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-PSW.Win32.Stealer.wsz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks for the presence of known windows from debuggers and forensic tools
• Network activity detected but not expressed in API logs
• CAPE detected the A310Logger malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Anomalous binary characteristics
• Binary compilation timestomping detected

How to determine Trojan-PSW.Win32.Stealer.wsz?

File Info:
name: F9E347F96F0DD8F20650.mlw
path: /opt/CAPEv2/storage/binaries/52a55ef38e18e52a389e818e9e22fac7b72d232dd918afd4bd62681761f31f1a
crc32: D729FF5B
md5: f9e347f96f0dd8f2065091e037bb8b8b
sha1: fa12b307047f9b848ed33977fd6833d8e75c31a4
sha256: 52a55ef38e18e52a389e818e9e22fac7b72d232dd918afd4bd62681761f31f1a
sha512: 848cb9870968a3209f548380b8285acd2cc20d015d8ae659d731f713a9e84f06294f5d31fe6032ba3a90d03956538f4d69360de12cebdf6c506516efc03c6810
ssdeep: 24576:x8YeQaOhMFMGidaS5lsf5MAsZq2J5Y1ed/x2H5RnkT1L5CWqFKZIsYQGoP8FgVEA:5MFRQJYZyJiSZ2HfnkX6KVBP8iVR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B16533938B2126B1EFC06D79768FD44595BEAF319CCE25CD2025FA12F50AD0F442A3A7
sha3_384: 0cde82b209469adf1ce3ceb657f59d3706b37675620c5a8bf493224e51fd9b8f01d7c7e76416a6b7189c64d286a4e82f
ep_bytes: 558bec83c4f0b800104000e801000000
timestamp: 2087-04-20 16:09:05

Version Info:
Translation: 0x0000 0x04b0
Comments: Insidious
CompanyName: Insidious
FileDescription: Insidious
FileVersion: 1.6.2.0
InternalName: Insidious.exe
LegalCopyright: Insidious Copyright ©  2021
LegalTrademarks: 
OriginalFilename: Insidious.exe
ProductName: Insidious
ProductVersion: 1.6.2.0
Assembly Version: 1.6.2.0

Trojan-PSW.Win32.Stealer.wsz also known as:

How to remove Trojan-PSW.Win32.Stealer.wsz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.