About “Trojan-Spy.MSIL.Stealer.cia” infection

The Trojan-Spy.MSIL.Stealer.cia is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.MSIL.Stealer.cia virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Created a process from a suspicious location
• Creates a hidden or system file
• CAPE detected the EnigmaStub malware family
• Anomalous binary characteristics

How to determine Trojan-Spy.MSIL.Stealer.cia?

File Info:
name: D2A9DDA113C9FB529C04.mlw
path: /opt/CAPEv2/storage/binaries/c82562a15a0ce4ba8a97fee44f3d9fb57f5e31448ecf3c84cd0ae2d99977d554
crc32: E81BFA71
md5: d2a9dda113c9fb529c046a6c979ec57e
sha1: dda31cc1535e0072412b810e6d4b9eca8e910a8e
sha256: c82562a15a0ce4ba8a97fee44f3d9fb57f5e31448ecf3c84cd0ae2d99977d554
sha512: 292502a95ec53206a0b6c73607a9aa0a86960d3d211c15c44b8527efaefb01a4dbd3fe4d061594449b3729f0b2e01b7ed084af7b1e7139dd622ded2ee6593029
ssdeep: 196608:TmPOjgV491cyh8NX70XK9qH5zI2DiAUkRyAZfA:KGu0yx7gYIIETA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1726633693923F644FD271972EF90E6FA346EFE1509B1023E39997B3E0C780C86965358
sha3_384: 090587294439a2b9e3b024303a8a5baab5b60b7c6120a72c5bb481941f90508dfbce03dea6b5d10364b28d37e55b48c6
ep_bytes: 558bec83c4f0b800104000e801000000
timestamp: 2021-11-24 08:48:57

Version Info:
FileDescription: VGUnlocker
ProductName: VGUnlocker
FileVersion: 
ProductVersion: 
LegalCopyright: Copyright © 2021
OriginalFilename: VGUnlocker.exe
Translation: 0x0409 0x0000

Trojan-Spy.MSIL.Stealer.cia also known as:

How to remove Trojan-Spy.MSIL.Stealer.cia?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.