TrojanPSW.Pycoon removal

The TrojanPSW.Pycoon is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanPSW.Pycoon virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Spanish (Colombia)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location

How to determine TrojanPSW.Pycoon?

File Info:
name: 0E66CC289A5963AB2933.mlw
path: /opt/CAPEv2/storage/binaries/63ff9cbbe33586017c27dbd3984adc264a500387230edca860f5875c708bbe80
crc32: E457ECF2
md5: 0e66cc289a5963ab2933c139f99266ff
sha1: 41914f6f1d648fb7ff8f2f3458bb2377824c10e0
sha256: 63ff9cbbe33586017c27dbd3984adc264a500387230edca860f5875c708bbe80
sha512: 4e9394c2a7272de0dd6f5336e3bbb240cadc523d5729c90801e7c2c4a47cf75a282f28e16d12917ce46232d2ca43cd7c8fe8ea6b835ad0c2e18a53014f39f8bc
ssdeep: 6144:Ylg+LfR8IbsaUjW8FgMeI7+dJCsMyR2MDkrZzzlA:Ylg+TR8XJg/w+dUsMyR27rpz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D5747D10BBA0C035E5F711F44AB9A268B53E7EE15B2450CB63D52BEE5A356E0EC3131B
sha3_384: d9e9c63db898c686ac4a68b4b0e965f3bdf067332a36b14501ac15798a4230bd06269dc2afb98a6e9820e6bbc6a5dae3
ep_bytes: 8bff558bece866ee0000e8110000005d
timestamp: 2021-02-06 18:06:13

Version Info:
0: [No Data]

TrojanPSW.Pycoon also known as:

How to remove TrojanPSW.Pycoon?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.