Spy Trojan

Trojan-Spy.Win32.Stealer.riy removal instruction

Malware Removal

The Trojan-Spy.Win32.Stealer.riy is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Spy.Win32.Stealer.riy virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Steals private information from local Internet browsers
  • Exhibits behavior characteristic of iSpy Keylogger
  • Checks the CPU name from registry, possibly for anti-virtualization

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Trojan-Spy.Win32.Stealer.riy?


File Info:

crc32: DC3C3FB7
md5: 9f3fdaa99b92ec77044dbd24a3aa3df1
name: sixtus.exe
sha1: f629c71b012f9ba539e5ce975df01d17ab57f9f7
sha256: d7b568153671eb4c02301444474dd55a52365c90dd18b360b641a40fa59bb10b
sha512: 090df6cc421b435be0bad52c8e3fb0938b4d7ad55ac92b6a4be364d1a8cd948434906e3f6f383ec45ec3e3bd99190bca8db6d668941fe0c4803e1956bbb145d2
ssdeep: 24576:PAHnh+eWsN3skA4RV1Hom2KXSmdaeOJ+PYvfL2GFepgGz2Z7PR2eWv9igyox1Wa:yh+ZkldoPKi2aevYRgsPaQgx3pf
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0809 0x04b0

Trojan-Spy.Win32.Stealer.riy also known as:

MicroWorld-eScanTrojan.GenericKD.42524825
FireEyeGeneric.mg.9f3fdaa99b92ec77
ALYacTrojan.Agent.HawkEye
CylanceUnsafe
SangforMalware
K7AntiVirusTrojan ( 005604fe1 )
BitDefenderTrojan.GenericKD.42524825
K7GWTrojan ( 005604fe1 )
Cybereasonmalicious.b012f9
TrendMicroTROJ_GEN.R002C0DBB20
F-ProtW32/AutoIt.KF.gen!Eldorado
SymantecPacked.Generic.548
APEXMalicious
AvastScript:SNH-gen [Trj]
ClamAVWin.Trojan.Autoit-7585910-0
GDataTrojan.GenericKD.42524825
KasperskyTrojan-Spy.Win32.Stealer.riy
AlibabaTrojan:Win32/autoit.ali2000008
AegisLabTrojan.Win32.AutoIT.4!c
RisingTrojan.Obfus/Autoit!1.C045 (CLASSIC)
Ad-AwareTrojan.GenericKD.42524825
EmsisoftTrojan.GenericKD.42524825 (B)
F-SecureTrojan.TR/BAS.Samca.oiycd
DrWebTrojan.Siggen8.58785
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Downloader.tc
MaxSecureTrojan.Malware.300983.susgen
Trapminemalicious.moderate.ml.score
SophosTroj/Steal-FT
IkarusTrojan-Spy.HawkEye
CyrenW32/AutoIt.KF.gen!Eldorado
WebrootW32.Infostealer.Gen
AviraTR/BAS.Samca.oiycd
MAXmalware (ai score=84)
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D288E099
ZoneAlarmTrojan-Spy.Win32.Stealer.riy
MicrosoftTrojan:Win32/AutoitInject.BH!MTB
AhnLab-V3Trojan/AU3.Wacatac.S1079
McAfeeArtemis!9F3FDAA99B92
TACHYONTrojan/W32.Agent.2077696.D
MalwarebytesTrojan.MalPack.AutoIt
PandaTrj/CI.A
ZonerTrojan.Win32.87579
ESET-NOD32a variant of Win32/Injector.Autoit.FBR
TrendMicro-HouseCallTROJ_GEN.R002C0DBB20
TencentWin32.Trojan.Inject.Auto
YandexTrojan.AvsArher.bS970C
eGambitUnsafe.AI_Score_99%
FortinetAutoIt/Injector.EZY!tr
AVGScript:SNH-gen [Trj]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_90% (W)
Qihoo-360Win32/Trojan.Spy.566

How to remove Trojan-Spy.Win32.Stealer.riy?

Trojan-Spy.Win32.Stealer.riy removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment