Trojan

How to remove “Trojan.Win32.Copak.ljdw”?

Malware Removal

The Trojan.Win32.Copak.ljdw is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Win32.Copak.ljdw virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Deletes its original binary from disk
  • Created a process from a suspicious location
  • Creates a copy of itself

How to determine Trojan.Win32.Copak.ljdw?


File Info:

name: B2979F4CCE4A953C72DC.mlw
path: /opt/CAPEv2/storage/binaries/0a982eb4b24675023ad3f8b4aad26777a7861ad7318c2130e198b6107d8148c5
crc32: 03E7E7B4
md5: b2979f4cce4a953c72dce8dbc51bf761
sha1: af900e909b3f0cf1107905ed044a4f2911d841b7
sha256: 0a982eb4b24675023ad3f8b4aad26777a7861ad7318c2130e198b6107d8148c5
sha512: d30c330f05778e2add7a08ac063b7ac8c43c82a20564c49a4452a0dafd04c6fe01683a331312bcc8b6d02533a9db99bad7e66f72bea5affd3e55e13c364f8e18
ssdeep: 12288:kZvhYcn4oLADbfU+pOaahTL5PS3RkriLF+k3iIdM8qZCxt/mdRyUAsJPpOaahTLW:kZcocDLUFf5PSdpAG2RyUbsf5PS/
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1B30501783A04C81AE8D1D979B273D15E06F432B72A7D2B978E4450302B849CFD51FEEA
sha3_384: 2d09963afcd783bb9a094761310a3bfbfef39381cb8bdf63dd0dafc88e63f6409f9e0b646fc27b01fcce43aed8104bc8
ep_bytes: bf8c80bcdf68d885400081eb35401483
timestamp: 1970-01-01 00:00:00

Version Info:

0: [No Data]

Trojan.Win32.Copak.ljdw also known as:

LionicTrojan.Win32.Copak.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Razy.870640
FireEyeGeneric.mg.b2979f4cce4a953c
McAfeeGlupteba-FTSD!B2979F4CCE4A
MalwarebytesTrojan.Injector
ZillyaTrojan.Injector.Win32.1348049
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 00577ea11 )
AlibabaTrojan:Win32/Copak.3496a97e
K7GWTrojan ( 00577ea11 )
Cybereasonmalicious.cce4a9
CyrenW32/Zbot.W.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Injector.DZQA
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Malware.Razy-9933824-0
KasperskyTrojan.Win32.Copak.ljdw
BitDefenderGen:Variant.Razy.870640
NANO-AntivirusVirus.Win32.Gen-Crypt.ccnc
ViRobotTrojan.Win32.Z.Razy.821249.KHE
AvastWin32:Trojan-gen
TencentTrojan.Win32.Copak.wc
Ad-AwareGen:Variant.Razy.870640
EmsisoftGen:Variant.Razy.870640 (B)
DrWebTrojan.Siggen14.7487
TrendMicroTROJ_GEN.R002C0DA622
McAfee-GW-EditionBehavesLike.Win32.Glupteba.cc
SophosMal/Generic-R + Troj/Agent-BGOS
GDataGen:Variant.Razy.870640
JiangminTrojan.Copak.bnpg
AviraTR/Crypt.XPACK.Gen
Antiy-AVLTrojan/Generic.ASMalwS.34EFACC
GridinsoftRansom.Win32.Wacatac.sa
MicrosoftTrojan:Win32/Glupteba.DB!MTB
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.RL_Generic.R293305
BitDefenderThetaGen:NN.ZexaF.34160.YuZ@aSwc1te
ALYacGen:Variant.Razy.870640
MAXmalware (ai score=88)
VBA32BScope.Trojan.Wacatac
TrendMicro-HouseCallTROJ_GEN.R002C0DA622
RisingTrojan.Injector!1.CD26 (RDMK:cmRtazpmSIN8b5fQOe88R01r6/ut)
YandexTrojan.Copak!pEGheOIzr/4
SentinelOneStatic AI – Malicious PE
FortinetW32/GenKryptik.CTNW!tr
AVGWin32:Trojan-gen
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan.Win32.Copak.ljdw?

Trojan.Win32.Copak.ljdw removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment