Trojan.Win32.Copak.qeir (file analysis)

The Trojan.Win32.Copak.qeir is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Copak.qeir virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Deletes its original binary from disk
• Created a process from a suspicious location
• Creates a copy of itself

How to determine Trojan.Win32.Copak.qeir?

File Info:
name: 4A98C054C2CA4FC9B4E3.mlw
path: /opt/CAPEv2/storage/binaries/c5857c38cc20b65c13e69de8dfe96ca2fd415b5aec88522ff30518bf652e2cc2
crc32: 97623FF6
md5: 4a98c054c2ca4fc9b4e362f4186a4f53
sha1: 72d15108faa8dd00c9610ada2396bdaa724d0dbc
sha256: c5857c38cc20b65c13e69de8dfe96ca2fd415b5aec88522ff30518bf652e2cc2
sha512: 137c6f118aa94d8179d9d20a81a89cc9a316056c36746d9ff77e9a8ab95786120c47f1badcb237669282ed1bb9c10622eaf7862aa8dbd93a17771dd8b365dab3
ssdeep: 49152:DCX93hCX9w+X93hCX97X93hCX9w+X93hCX9y:SH2hH25H2hH2M
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T161A5CE9B5B273223C9F98BB99F3C12B501FB3F0AE1A4853CC3E51A04B4E936765B1195
sha3_384: cd5254be5d1bf1ba9c49675cb7bb7bf6aae96842150334b369c0c4774b5948616f2dda3867648ae7c463fa7da2ebf029
ep_bytes: bbb6ef4f8668d885400083ec04c70424
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan.Win32.Copak.qeir also known as:

How to remove Trojan.Win32.Copak.qeir?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.