About “Trojan.Win32.Copak.ahmcq” infection

The Trojan.Win32.Copak.ahmcq is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Copak.ahmcq virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Creates a copy of itself
• Deletes executed files from disk
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.Win32.Copak.ahmcq?

File Info:
name: DF0354C03903EB9CCD10.mlw
path: /opt/CAPEv2/storage/binaries/2df5347a3bdd397da30ba6cfe4f4a3710180c71fd174cbbe2f80eee9830525e2
crc32: BFBCBFA9
md5: df0354c03903eb9ccd10fe3e1db20b76
sha1: 5e4f99b8390b5b4e6be45220a5581004c2f54e90
sha256: 2df5347a3bdd397da30ba6cfe4f4a3710180c71fd174cbbe2f80eee9830525e2
sha512: 76e1460a2fc34801deb6a952e382b91edb7ee5ec8dbd38c57dfc3e4abba930ba2f6b37c769c327a35658a490c8724ecd35a077c87b15cf3c842415c9c04f3eb9
ssdeep: 12288:g0dOsfgk0npM4dl0v5JHpS0wULVnMhysFjm+0npM4dl0v5JEe:JTfgkEM4dmv5Xf+hPEM4dmv52e
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17E05CFC7B64CAE55C87D32731D393249A783B9BA2D29B91E24EC877F5653C3B418B210
sha3_384: 3a3c22c704f6006f624dd9c170b3dd3af2fae5443d158acf2e0ade55275e5f6d9df48062a259ba312cdf58868e652520
ep_bytes: eb389953bb612dd4beb014457cf37cff
timestamp: 1971-05-16 00:00:00

Version Info:
CompanyName: Wayne J. Radburn
FileDescription: PE/COFF File Viewer
FileVersion: 0.9.9.0
InternalName: PEview
LegalCopyright: Copyright© 1997-2011 Wayne J. Radburn
OriginalFilename: PEview.exe
ProductName: PEview
ProductVersion: 0.9.9.0
Translation: 0x0409 0x04e4

Trojan.Win32.Copak.ahmcq also known as:

How to remove Trojan.Win32.Copak.ahmcq?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.