Spy Trojan

About “Trojan-Spy.Win32.Stealer.cijz” infection

Malware Removal

The Trojan-Spy.Win32.Stealer.cijz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan-Spy.Win32.Stealer.cijz virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Sample contains Overlay data
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • CAPE detected the RedLine malware family
  • Anomalous binary characteristics

How to determine Trojan-Spy.Win32.Stealer.cijz?


File Info:

name: BEC567D68B40B56B2E85.mlw
path: /opt/CAPEv2/storage/binaries/7f4018ec1ab0179aa0f45179263a219d0ff4f0655120491147526662f40e90bd
crc32: 52088724
md5: bec567d68b40b56b2e85447468698dea
sha1: a9053c676095a03e26908c61df6866bfbc1300b6
sha256: 7f4018ec1ab0179aa0f45179263a219d0ff4f0655120491147526662f40e90bd
sha512: 49366086d52446c1ff979da167122d8d04961ae1511d21aca73b21e37007e6bf7c212992bef2bf4b6844e60fdd93415c1d56b136faefdc997146717ae3e20ece
ssdeep: 24576:M5dHB8Y2PsYAYHfyIHCEMv0dI5H6oi4b1iydDo4N8fmSLc:M3Br2bkXBVo4N8fmSA
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T193657C39EB0615B4DA235771C5DEEB7B97047A248032AE3BFF4AEE0CA4331127C95196
sha3_384: 7a037013f9ade3c58f89a820484a079dcef1aea3ca35137b13bc94d6c30cb218ce47a349b72520a1a06f6587bcf835ce
ep_bytes: 83ec0cc705b853520000000000e82e11
timestamp: 1970-01-01 00:00:00

Version Info:

0: [No Data]

Trojan-Spy.Win32.Stealer.cijz also known as:

Elasticmalicious (high confidence)
CynetMalicious (score: 100)
FireEyeTrojan.GenericKDZ.90362
McAfeeGenericRXTT-PN!BEC567D68B40
CylanceUnsafe
VIPRETrojan.GenericKDZ.90362
K7AntiVirusTrojan ( 005964f71 )
K7GWTrojan ( 005964f71 )
CrowdStrikewin/malicious_confidence_60% (W)
CyrenW32/Trojan.HLPX-5019
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/GenKryptik.FYAX
APEXMalicious
KasperskyTrojan-Spy.Win32.Stealer.cijz
BitDefenderTrojan.GenericKDZ.90362
MicroWorld-eScanTrojan.GenericKDZ.90362
AvastWin32:Trojan-gen
Ad-AwareTrojan.GenericKDZ.90362
EmsisoftTrojan.GenericKDZ.90362 (B)
DrWebTrojan.PWS.Stealer.32450
McAfee-GW-EditionArtemis
Trapminemalicious.moderate.ml.score
SophosMal/Generic-S
IkarusTrojan.Win32.Crypt
GDataWin32.Trojan.PSE.1DV6CWU
AviraTR/Kryptik.inubd
ArcabitTrojan.Generic.D160FA
MicrosoftTrojan:Win32/Wacatac.B!ml
AhnLab-V3Trojan/Win.AO.R507708
ALYacTrojan.GenericKDZ.90362
MAXmalware (ai score=88)
VBA32BScope.TrojanPSW.Arkei
MalwarebytesMalware.AI.3644025339
RisingSpyware.Convagent!8.12330 (TFE:dGZlOgUz6kFAynQuKA)
SentinelOneStatic AI – Malicious PE
FortinetW32/Kryptik.HPDK!tr
AVGWin32:Trojan-gen

How to remove Trojan-Spy.Win32.Stealer.cijz?

Trojan-Spy.Win32.Stealer.cijz removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment