Trojan-Spy.Win32.Stealer.dmcg (file analysis)

The Trojan-Spy.Win32.Stealer.dmcg is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Stealer.dmcg virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the RedLine malware family
• Deletes executed files from disk
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan-Spy.Win32.Stealer.dmcg?

File Info:
name: AFF0BDFCE5EFC5F78420.mlw
path: /opt/CAPEv2/storage/binaries/f63fe2094b35dce2b49cb9c9cd8e76a4bc5791c7c25475889c46f9f887959b9d
crc32: D209AB58
md5: aff0bdfce5efc5f78420a74b685e551a
sha1: d33fa1c0c6e8c0ad0d68b1913426f19637bd4193
sha256: f63fe2094b35dce2b49cb9c9cd8e76a4bc5791c7c25475889c46f9f887959b9d
sha512: 95ec41eaf21325184d9c0236461a778b30573929759345efab9c07ca6585006f7c1ee9fe5a8b547794c699ca6b41c1914ef41f4ff39b5cd4778ec2fbc9809858
ssdeep: 12288:wMrdy900OdfOL9K5UbTQ6/x0YZTRlcEcXaQDR/hCslSdO7m+ze0:9yWO5K5UZJdRuEJMR/hAQJq0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DFE41353BBE94433F8B617B02CFB02931F367CA16D38531B2296555E0CB2B84A836767
sha3_384: 37a508a2d3bf4600ccc2b9c5bf3b5ffd9f209503cfb6868967dc39516f2472e5071f6eb7d80114c221542a09242d8a2b
ep_bytes: e8f0060000e9000000006a5868b87240
timestamp: 2022-05-24 22:49:06

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor                                           
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
Translation: 0x0409 0x04b0

Trojan-Spy.Win32.Stealer.dmcg also known as:

How to remove Trojan-Spy.Win32.Stealer.dmcg?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.