Categories: Trojan

Trojan-PSW.Win64.Stealer.gj removal guide

The Trojan-PSW.Win64.Stealer.gj is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-PSW.Win64.Stealer.gj virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Executable file is packed/obfuscated with Themida
Authenticode signature is invalid
Checks for the presence of known windows from debuggers and forensic tools
Checks the version of Bios, possibly for anti-virtualization
Anomalous binary characteristics

How to determine Trojan-PSW.Win64.Stealer.gj?


File Info:
name: 7C6C9BAC17538636833E.mlwpath: /opt/CAPEv2/storage/binaries/c8056a303f97ec2f28373963b3fa839c8e95d8935997f9adf9546df923e913efcrc32: 48082FD7md5: 7c6c9bac17538636833e16e3471955absha1: 6cd1dd83545e9431960b15a2bf262c0a3cc2f37csha256: c8056a303f97ec2f28373963b3fa839c8e95d8935997f9adf9546df923e913efsha512: 93ab35d0e4f2581d38853a5a9f70852ee1892d16dbf7cc6e762ecc2473af43040e626094ea1e04ee136296dc9acaa315a1c7084af1e083af749466aa9c6c337bssdeep: 98304:DecRkvRv7CAY55plXHssrtIxMzWdxD3dQ/5XYJ3M/7b1HTeTXgTHk:Dbc7TYnBY3W/J/7xz4XOHktype: PE32+ executable (GUI) x86-64, for MS Windowstlsh: T1675633B744C53BDAC0B5EBFD5D1A100884A06E13460645B5F1AF59BBAFDC4ADC3A2BC2sha3_384: 6bb94d2e3e14de49bedb70cf10e67125c79105953fe8a63cff2e156a2a06e9d2bb9ca617da7edec5d84299e62295980bep_bytes: e88201000041524989e24152498b7210timestamp: 2022-11-13 17:39:47
Version Info:
0: [No Data]

Trojan-PSW.Win64.Stealer.gj also known as:

Lionic	Trojan.Win64.Agentb.trtl
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.63731774
FireEye	Generic.mg.7c6c9bac17538636
McAfee	Artemis!7C6C9BAC1753
Malwarebytes	Spyware.PasswordStealer
Sangfor	Trojan.Win64.Agent.Vj6r
Alibaba	TrojanPSW:Win64/Stealer.1ee08251
Cybereason	malicious.3545e9
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-PSW.Win64.Stealer.gj
BitDefender	Trojan.GenericKD.63731774
Avast	Win64:Evo-gen [Trj]
Tencent	Win64.Trojan-QQPass.QQRob.Czlw
McAfee-GW-Edition	BehavesLike.Win64.Trickbot.tc
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1235344
Microsoft	Trojan:Script/Wacatac.H!ml
GData	Trojan.GenericKD.63731774
AhnLab-V3	Trojan/Win.Agent.R534769
Acronis	suspicious
MAX	malware (ai score=89)
Rising	Stealer.Agent!8.C2 (CLOUD)
AVG	Win64:Evo-gen [Trj]