About “Trojan-Spy.Win32.Stealer.ajyw” infection

The Trojan-Spy.Win32.Stealer.ajyw is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Stealer.ajyw virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Tries to suspend Cuckoo threads to prevent logging of malicious activity
• Created a process from a suspicious location
• Anomalous binary characteristics

Related domains:

How to determine Trojan-Spy.Win32.Stealer.ajyw?

File Info:
name: C27BD084CEA5171F21D6.mlw
path: /opt/CAPEv2/storage/binaries/694dcfb943f235600b0f748f6c9b2896ef1160a8e6220f249c6fd691347520f9
crc32: 1F81B7D2
md5: c27bd084cea5171f21d6f63de2fc293d
sha1: 09fd106e0eeb2e2562a8ef9825765599c05c43ca
sha256: 694dcfb943f235600b0f748f6c9b2896ef1160a8e6220f249c6fd691347520f9
sha512: 532aead3b53c99ea872140d91d300bc20bc5ddfaebc378bb724141b336f589c0edf65d7627961b61fd591310b3447f9f367389a5c047486811059949b311a1af
ssdeep: 196608:0+ncDRzL3EcdbafrCYAamNegCi/PgTb1MHbnUisk/Jf6W7g5rWd5:0hDRP3EsbkOYAa6dPgn2bnsY37g5rWd5
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E796330B23D5C231C21354B063F48F91BBAB727D1699D18BBB64972AAB719F5C706332
sha3_384: b1ccea6753964e16ef9b34fe02fab4448d2b372f3b1becc71502c666188e8a5414b733d144776a24ba58e3fc68ac5076
ep_bytes: e885630000e978feffff8bff558bec56
timestamp: 2015-02-15 08:00:31

Version Info:
FileDescription: Resynchronised Commentable
InternalName: Impersuadability
OriginalFilename: Metempsychosic
CompanyName: Trophoplasmic Nonlinearly
LegalCopyright: Copyright (C) 2000-2021 Underzealously
ProductName: Simultaneity Semivitrification
FileVersion: 8.2.1.5
ProductVersion: 8.2.1.5
Comments: Allotheria
LegalTrademarks: Squarrosely Antihelices
Title: Unhistorically Endopleurite
Assembly Version: 8.2.1.5
Translation: 0x0409 0x04b0

Trojan-Spy.Win32.Stealer.ajyw also known as:

How to remove Trojan-Spy.Win32.Stealer.ajyw?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.