How to remove “Trojan-Spy.Win32.Stealer.alij”?

The Trojan-Spy.Win32.Stealer.alij is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Stealer.alij virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Serbian (Cyrillic)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Detects Sandboxie through the presence of a library
• Queries information on disks, possibly for anti-virtualization
• Checks for the presence of known windows from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Detects VirtualBox through the presence of a device
• Anomalous binary characteristics
• Binary compilation timestomping detected

How to determine Trojan-Spy.Win32.Stealer.alij?

File Info:
name: BE1CCA289D19088C5943.mlw
path: /opt/CAPEv2/storage/binaries/7ffbfd3340ee676c493ddddce805d34505ab1fa3ddffedbe5c14e86554892f67
crc32: E73C32D5
md5: be1cca289d19088c59435334381bc4ad
sha1: ea55f4d5409ee06c457a8473401fe5d32774c01a
sha256: 7ffbfd3340ee676c493ddddce805d34505ab1fa3ddffedbe5c14e86554892f67
sha512: 22b73aed8e541b2d1dc7b2bc4e6d57cf8269abd9b9a50e0bc3b58716acff4ee852b6d9c0fccb97ca94da163862e4bf1985134a8cd59ee0e92659ce94d01d2d80
ssdeep: 24576:cg2/Xs2tyHCv/GQv4sMizmsImyxys0bl5hNjdLHXR:cg2/Xs2QY/GQvJMHd0b9ld9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13D3512416394C504F4B57EB068E902B29B2AFCAC9B30825F25C5BF1E35BC2A19F74B57
sha3_384: 46086511ebb3874528594030aa6a28ca58755273304b404a5835158cd8c37f5a61185c801a4d432c6a2ff9b70c0f29d9
ep_bytes: eb01de50eb0589bfb273a6e81b000000
timestamp: 2042-09-23 13:23:22

Version Info:
CompanyName: CRYPTOCOMPANY OU
FileDescription: CryptoTab Update Setup
FileVersion: 1.3.99.31
InternalName: CryptoTab Update Setup
LegalCopyright: Copyright 2018 CRYPTOCOMPANY OU
OriginalFilename: CryptoTabUpdateSetup.exe
ProductName: CryptoTab Update
ProductVersion: 1.3.99.31
LanguageId: en
PrivateBuild: 
Translation: 0x0409 0x04b0

Trojan-Spy.Win32.Stealer.alij also known as:

How to remove Trojan-Spy.Win32.Stealer.alij?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.