Trojan.StealerPMF.S25536671 removal tips

The Trojan.StealerPMF.S25536671 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.StealerPMF.S25536671 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Macedonian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the RedLine malware family
• Anomalous binary characteristics

How to determine Trojan.StealerPMF.S25536671?

File Info:
name: 3B76C49F6CF828FD13D1.mlw
path: /opt/CAPEv2/storage/binaries/c0377fe560d941f3076cc4360533d41bf9b963507b3d255fbafb16d82fe79a7a
crc32: 77760571
md5: 3b76c49f6cf828fd13d11796e9e2d2e5
sha1: dad187402d2e4878c68b2d734da82c7e0a2e358f
sha256: c0377fe560d941f3076cc4360533d41bf9b963507b3d255fbafb16d82fe79a7a
sha512: d18031e5428d11c09c70475947d5ae6ad55dde7d9381a829c430aecc2d28b1800077fd8ed61a1af3f325f49910757b922fec3984b35bff6be61c04ea09ef46e2
ssdeep: 6144:FFPqpmuOVLD/u6XYheBsndeKiUgOLzHusEHzPdy+bwROMwU:FFPYO1/ueYhiYxQOLas8EDV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10694DF1276D1C033C05660728D25C7B56EBAB4711766AACFBFD85EBD1F643C2A23530A
sha3_384: 70a78a55025f48e0210234163b893824083e507e7a11ca151c7b47871746089e053c26d32574eb68d9b9c82f4028838a
ep_bytes: e8bf890000e978feffff8bff558bec83
timestamp: 2020-09-12 05:43:15

Version Info:
FileVers: 65.51.36.16
ProductVersa: 7.50.25.71
InternalName: eatemas
LegalCopyrighd: Jdfglsdffa
Translations: 0x0169 0x0300

Trojan.StealerPMF.S25536671 also known as:

How to remove Trojan.StealerPMF.S25536671?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.