Categories: SpyTrojan

Trojan-Spy.Win32.Stealer.rkm removal

The Trojan-Spy.Win32.Stealer.rkm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Spy.Win32.Stealer.rkm virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Trojan-Spy.Win32.Stealer.rkm?


File Info:

crc32: B1BF527Emd5: b48d7a04374fcbd33ec8e12a467de319name: azo.exesha1: 71ebfbb59545416eebba8202bc4f169fa7f21d87sha256: 81b451d412d4dd03ff50113008a0d4072ddb407993027a87610bb78c8c41850csha512: 2c97352a9b71ad972c973d3daf34c5c805f586b13b07f2d0f3a0fdf3716c4215c0fe56f6e212f618b935bf91f741e5ca94e66d7b750bbb8cf830f7f307d49372ssdeep: 24576:qAHnh+eWsN3skA4RV1Hom2KXSmdaAxVmePl0gCLLqLyF/Lo5:9h+ZkldoPKi2aAxcgKym/Stype: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0809 0x04b0

Trojan-Spy.Win32.Stealer.rkm also known as:

MicroWorld-eScan Trojan.GenericKD.42572527
FireEye Generic.mg.b48d7a04374fcbd3
CAT-QuickHeal Trojan.Wacatac
Qihoo-360 Win32/Trojan.Spy.54c
McAfee Artemis!B48D7A04374F
Cylance Unsafe
AegisLab Trojan.Win32.Nymeria.4!c
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Trojan.GenericKD.42572527
K7GW Riskware ( 0040eff71 )
TrendMicro Trojan.Win32.WACATAC.THBABBO
F-Prot W32/Autoit.G.gen!Eldorado
Symantec Packed.Generic.548
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Autoit-7585910-0
GData Trojan.GenericKD.42572527
Kaspersky Trojan-Spy.Win32.Stealer.rkm
Alibaba TrojanSpy:Win32/Stealer.a55eaa90
NANO-Antivirus Trojan.Win32.AutoIt.hasrrq
Avast Script:SNH-gen [Trj]
Tencent Win32.Trojan-spy.Stealer.Pezl
Ad-Aware Trojan.GenericKD.42572527
Emsisoft Trojan.GenericKD.42572527 (B)
F-Secure Trojan.TR/Autoit.rcdoo
DrWeb Trojan.AutoIt.727
Invincea heuristic
McAfee-GW-Edition BehavesLike.Win32.Downloader.tc
Trapmine suspicious.low.ml.score
Sophos Mal/Generic-S
Cyren W32/Autoit.G.gen!Eldorado
Avira TR/Autoit.rcdoo
Endgame malicious (high confidence)
Arcabit Trojan.Generic.D2899AEF
ZoneAlarm Trojan-Spy.Win32.Stealer.rkm
Microsoft Trojan:Win32/Predator.BC!MTB
AhnLab-V3 Trojan/AU3.Wacatac.S1079
ALYac Spyware.AgentTesla
MAX malware (ai score=81)
Malwarebytes Trojan.MalPack.AutoIt
ESET-NOD32 a variant of Win32/Injector.Autoit.FBV
TrendMicro-HouseCall Trojan.Win32.WACATAC.THBABBO
Rising Trojan.Obfus/Autoit!1.C075 (CLASSIC)
Yandex Trojan.AvsArher.bS970C
Ikarus Trojan-Spy.Keylogger.AgentTesla
eGambit Unsafe.AI_Score_98%
Fortinet AutoIt/Injector.EZY!tr
AVG Script:SNH-gen [Trj]
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_100% (W)
MaxSecure Trojan.Malware.300983.susgen

How to remove Trojan-Spy.Win32.Stealer.rkm?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Trojan.Win32.Agent.xbocpf removal

The Trojan.Win32.Agent.xbocpf is considered dangerous by lots of security experts. When this infection is active,…

8 mins ago

What is “Malware.AI.4092848701”?

The Malware.AI.4092848701 is considered dangerous by lots of security experts. When this infection is active,…

9 mins ago

About “Trojan.Generic.35764356” infection

The Trojan.Generic.35764356 is considered dangerous by lots of security experts. When this infection is active,…

14 mins ago

What is “Generic.Dacic.94CCEEA9.A.D4FB9FDA”?

The Generic.Dacic.94CCEEA9.A.D4FB9FDA is considered dangerous by lots of security experts. When this infection is active,…

19 mins ago

What is “MSILHeracles.58916”?

The MSILHeracles.58916 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

About “TrojanDownloader:Win32/Beebone.AZ” infection

The TrojanDownloader:Win32/Beebone.AZ is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago