Spy Trojan

Trojan-Spy.Win32.Stealer.abio removal

Malware Removal

The Trojan-Spy.Win32.Stealer.abio is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Spy.Win32.Stealer.abio virus can do?

  • Executable code extraction
  • Creates RWX memory
  • The binary likely contains encrypted or compressed data.
  • Checks for the presence of known windows from debuggers and forensic tools
  • Tries to unhook or modify Windows functions monitored by Cuckoo
  • Network activity detected but not expressed in API logs
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Anomalous binary characteristics

How to determine Trojan-Spy.Win32.Stealer.abio?


File Info:

crc32: 9445079F
md5: cf9103c3643f099ff2b4bf9d7258c54f
name: CF9103C3643F099FF2B4BF9D7258C54F.mlw
sha1: d9783a2381c3da1cf394844ee35d6662992e0766
sha256: 8d5183e16553bfad76d68b950d94144e5d57633c716074ca3d76cf6e6903918f
sha512: fb85d5b7fe1e5da2f2dd472ad3470713ae05d183c458b101dd93eef24ce6205b91a2f54bd19945b246fb62b3d213dd9b03de1e723d26c88ff9dff93b3c30c555
ssdeep: 49152:Zgw8gCbfwf3saJZrvyu2nJZ7s1lEgx5tmOfy8RuiOkO9G0rgf/VXiPo1LHkqdi8:Zf4w/saJpGJJs1jx5fyouR7G0UnVSPyt
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:

Translation: 0x0000 0x04b0
LegalCopyright:
Assembly Version: 0.0.0.0
InternalName: Wives.exe
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
FileDescription:
OriginalFilename: Wives.exe

Trojan-Spy.Win32.Stealer.abio also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Agent.m!c
Elasticmalicious (high confidence)
ClamAVWin.Packed.Razy-9883428-0
ALYacGen:Variant.Razy.600165
CylanceUnsafe
SangforSuspicious.Win32.Save.a
CrowdStrikewin/malicious_confidence_90% (W)
AlibabaPacked:Win32/Themida.059f8aae
K7GWTrojan ( 0057a2f61 )
K7AntiVirusTrojan ( 0057a2f61 )
CyrenW32/Razy.HG.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.Themida.HTI
APEXMalicious
AvastWin32:Trojan-gen
CynetMalicious (score: 100)
KasperskyTrojan-Spy.Win32.Stealer.abio
BitDefenderGen:Variant.Razy.600165
NANO-AntivirusVirus.Win32.Gen-Crypt.ccnc
MicroWorld-eScanGen:Variant.Razy.600165
TencentWin32.Trojan.Razy.Tclt
Ad-AwareGen:Variant.Razy.600165
SophosML/PE-A
F-SecureTrojan.TR/Crypt.XPACK.Gen
BitDefenderThetaGen:NN.ZexaF.34142.9I0@aaiXUqki
McAfee-GW-EditionBehavesLike.Win32.Generic.vc
FireEyeGeneric.mg.cf9103c3643f099f
EmsisoftGen:Variant.Razy.600165 (B)
SentinelOneStatic AI – Malicious PE
WebrootW32.Trojan.FL
AviraTR/Crypt.XPACK.Gen
KingsoftWin32.Heur.KVMH008.a.(kcloud)
MicrosoftTrojan:Win32/Malgent!MSR
GridinsoftTrojan.Heur!.032100A1
ArcabitTrojan.Razy.D92865
GDataGen:Variant.Razy.600165
AhnLab-V3Trojan/Win.Generic.R436734
Acronissuspicious
McAfeeArtemis!CF9103C3643F
MAXmalware (ai score=82)
VBA32BScope.TrojanPSW.Agent
MalwarebytesTrojan.MalPack.Themida
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_GEN.R002H0CII21
RisingTrojan.Generic@ML.100 (RDMK:qMVBHZykg7wwPs2P/6ON1Q)
IkarusTrojan.Win32.Themida
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/PossibleThreat
AVGWin32:Trojan-gen
Paloaltogeneric.ml

How to remove Trojan-Spy.Win32.Stealer.abio?

Trojan-Spy.Win32.Stealer.abio removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment