What is “Trojan:Win32/GoldenSpy.A”?

The Trojan:Win32/GoldenSpy.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/GoldenSpy.A virus can do?

Authenticode signature is invalid
CAPE detected the GoldenSpy malware family
Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/GoldenSpy.A?


File Info:
name: 72C7004537CD158B0D80.mlw
path: /opt/CAPEv2/storage/binaries/f89e898ea40e10901c0c9f9100f269a227323ace1f7248293bfd57982dea1a67
crc32: 8218E4E6
md5: 72c7004537cd158b0d80f07d65e71f6b
sha1: 8d07cbd90527568c90f6cb481a1a21853c8b2524
sha256: f89e898ea40e10901c0c9f9100f269a227323ace1f7248293bfd57982dea1a67
sha512: 8514eac88531d66e629e1756e7ec5fc41547ddbe2af00dc5ae6c7193f47108864c0487968c1b70e7b4d029da59b2543a34f4a4b5ae7885166bc1c65657c3275f
ssdeep: 12288:QJ9YFdXP8pxf1HUh9P8EUDUJ1eMWoCeM/YTTZJ:GYasn8EUDUDeMGeMiTZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12EB49E15B952C036C57241304D38EB7681AEBA641F374AEB73D80B2D6E706D26B36E37
sha3_384: 2f63e175714876ae25658ab50c001ea9d8d1d340f3624b3e01bdcb4e08df76696c9afa099a2ea9fae228c62a733cb470
ep_bytes: e8dc080000e974feffff558becff7508
timestamp: 2020-03-23 13:05:34

Version Info:
0: [No Data]

Trojan:Win32/GoldenSpy.A also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agentb.4!c
MicroWorld-eScan	Trojan.GenericKD.46605357
FireEye	Generic.mg.72c7004537cd158b
CAT-QuickHeal	Backdoor.GoldenSpy.S14495536
Skyhigh	BehavesLike.Win32.AdwareLinkury.hh
McAfee	Trojan-FSQQ!72C7004537CD
Malwarebytes	Generic.Malware/Suspicious
Zillya	Trojan.Agent.Win32.1318383
Sangfor	Trojan.Win32.Agentb.jyib
K7AntiVirus	Trojan ( 00564e581 )
Alibaba	Trojan:Win32/GOLDENSPY.8cef24af
K7GW	Trojan ( 00564e581 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D2C7242D
BitDefenderTheta	AI:Packer.83656C2A1F
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.UEL
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Agentb.jyib
BitDefender	Trojan.GenericKD.46605357
NANO-Antivirus	Trojan.Win32.Ulise.hnapfo
Avast	Win32:TrojanX-gen [Trj]
Tencent	Win32.Trojan.Agentb.Qcnw
Emsisoft	Trojan.GenericKD.46605357 (B)
DrWeb	Trojan.Siggen9.56860
VIPRE	Trojan.GenericKD.46605357
TrendMicro	Backdoor.Win32.GOLDENSPY.YPAH-A
Sophos	Mal/Generic-R
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Agentb.gwc
Webroot	W32.Trojan.Gen
Google	Detected
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Win32.Agent
Kingsoft	malware.kb.a.928
Microsoft	Trojan:Win32/GoldenSpy.A
ViRobot	Trojan.Win32.S.Agent.516096.JW
ZoneAlarm	Trojan.Win32.Agentb.jyib
GData	Trojan.GenericKD.46605357
Varist	W32/Trojan.HWQ.gen!Eldorado
AhnLab-V3	Trojan/Win32.GoldenSpy.R335573
VBA32	BScope.Trojan.Agentb
ALYac	Trojan.Agent.Ashify
TACHYON	Backdoor/W32.GoldenSpy.516096
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Backdoor.Win32.GOLDENSPY.YPAH-A
Rising	Backdoor.GoldenSpy!1.C82E (CLASSIC)
Ikarus	Trojan.Win32.Agent
MaxSecure	Trojan.Malware.87187890.susgen
Fortinet	W32/Agent.UEL!tr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/GoldenSpy.A?

Trojan:Win32/GoldenSpy.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X