Trojan

Trojan.Win32.Copak.lffc removal tips

Malware Removal

The Trojan.Win32.Copak.lffc is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Win32.Copak.lffc virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Deletes its original binary from disk
  • Created a process from a suspicious location
  • Creates a copy of itself

How to determine Trojan.Win32.Copak.lffc?


File Info:

name: C3ED07AC18FBF91E4BD9.mlw
path: /opt/CAPEv2/storage/binaries/0ea32087f1eac3711a2b6fd19b060bb0d4b842a662f03fd5abfec498a2c7acc4
crc32: 243A2274
md5: c3ed07ac18fbf91e4bd9f866e8ca89ce
sha1: aa996a33c388195799a7ca8b35b2169cd9926127
sha256: 0ea32087f1eac3711a2b6fd19b060bb0d4b842a662f03fd5abfec498a2c7acc4
sha512: 97cc9d2642ff5c29f31fd87a4a71a33aadcdecb35392cc5aa122a87a8a68aa6b6e55ef83d478d4e75b3abdb5f0f976463d7d256bf3ecce477651a5f64382e299
ssdeep: 3072:rJ6bCC9td3E82qbMevKxuled8pT5ETsD7WAejsa9M6MdojPydl:rJ3IneqbM6qyTSTsvNe42MdojIl
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1C2F3CF406CBB1117E343507A3A49137A8E29AA43FA7FC96FD61F03894FDB49989835D3
sha3_384: 00d4a43ea8543f0b2f9b1f5f63de7c92f790fd29124ea01cc29b7c1b04239a1e6e474936ff582174a1c5c67e99bdf066
ep_bytes: b97503508c81efb3bfd54c68d8854000
timestamp: 1970-01-01 00:00:00

Version Info:

0: [No Data]

Trojan.Win32.Copak.lffc also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Copak.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Razy.865537
FireEyeGeneric.mg.c3ed07ac18fbf91e
McAfeeArtemis!C3ED07AC18FB
CylanceUnsafe
SangforSuspicious.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojan:Win32/Glupteba.99f0b8d4
K7GWTrojan ( 00577ea11 )
K7AntiVirusTrojan ( 00577ea11 )
BitDefenderThetaGen:NN.ZexaF.34114.kuZ@aeSC5Sd
CyrenW32/Zbot.W.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Injector.DZQA
APEXMalicious
KasperskyTrojan.Win32.Copak.lffc
BitDefenderGen:Variant.Razy.865537
NANO-AntivirusVirus.Win32.Gen-Crypt.ccnc
AvastWin32:Evo-gen [Susp]
TencentMalware.Win32.Gencirc.10ce896e
Ad-AwareGen:Variant.Razy.865537
EmsisoftGen:Variant.Razy.865537 (B)
DrWebTrojan.Siggen14.7487
TrendMicroTROJ_GEN.R002C0DLR21
McAfee-GW-EditionBehavesLike.Win32.Glupteba.cc
SophosML/PE-A + Troj/Agent-BGOS
GDataGen:Variant.Razy.865537
MaxSecureTrojan.Malware.300983.susgen
AviraTR/Crypt.XPACK.Gen
MAXmalware (ai score=82)
Antiy-AVLTrojan/Generic.ASMalwS.336C025
GridinsoftRansom.Win32.Wacatac.sa
ArcabitTrojan.Razy.DD3501
MicrosoftTrojan:Win32/Glupteba.DB!MTB
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.RL_Generic.R293305
VBA32BScope.Trojan.Wacatac
ALYacGen:Variant.Razy.865537
MalwarebytesTrojan.Crypt
TrendMicro-HouseCallTROJ_GEN.R002C0DLR21
RisingTrojan.Kryptik!1.BF57 (CLASSIC)
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_86%
FortinetW32/Copak.AGMG!tr
AVGWin32:Evo-gen [Susp]
Cybereasonmalicious.c18fbf

How to remove Trojan.Win32.Copak.lffc?

Trojan.Win32.Copak.lffc removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment