How to remove “Trojan-Spy.Win32.Stealer.cccl”?

The Trojan-Spy.Win32.Stealer.cccl is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Stealer.cccl virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Expresses interest in specific running processes
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Executable file is packed/obfuscated with Themida
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Detects Sandboxie through the presence of a library
• Checks for the presence of known windows from debuggers and forensic tools
• The following process appear to have been packed with Themida: 90ADE22E45FF94D9E07B.mlw
• Checks the version of Bios, possibly for anti-virtualization
• Detects VirtualBox through the presence of a registry key
• Attempts to modify proxy settings
• Collects information to fingerprint the system
• Anomalous binary characteristics

How to determine Trojan-Spy.Win32.Stealer.cccl?

File Info:
name: 90ADE22E45FF94D9E07B.mlw
path: /opt/CAPEv2/storage/binaries/b0b3cf6d05e09c3e051e0a0b653f194c3cafdde345bfd85e6364b3e26a7b6f00
crc32: 1BB09777
md5: 90ade22e45ff94d9e07b978bb745a5bd
sha1: 0217c907fe8fc91dbdbfbdb3cbb94d0a482abb0e
sha256: b0b3cf6d05e09c3e051e0a0b653f194c3cafdde345bfd85e6364b3e26a7b6f00
sha512: f7a3fcad2828953d7f35fe9d38652f34b97829c4cc31ad1dc163fe5953790518df7cb329c4aebab98fd607af58f0f07ec423ec8f2e43fb57e9c79b24d814499b
ssdeep: 98304:ut87jeKFvRJfZsYgMkwPf4Z4WqR+YpkNko8qJwzw9xYdJ3:uty6W/tbWqvaH8UwzwPYdJ3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15D2623732325004AE5D2CC3685377DE571FA1B2B8F42B878A2DA7DC528629A0E353DC7
sha3_384: df4e7b7094ff5f9fea4550b0426cf15ae27bed5481abe11ce12bea5d54bfc95037b27072baa7973ae44cc5396d67a712
ep_bytes: 687c6b7ec7e8ad81ffff33daf86685e9
timestamp: 2022-05-26 13:58:25

Version Info:
0: [No Data]

Trojan-Spy.Win32.Stealer.cccl also known as:

How to remove Trojan-Spy.Win32.Stealer.cccl?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.