Trojan:Win32/Occamy.CCB malicious file

The Trojan:Win32/Occamy.CCB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Occamy.CCB virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Sniffs keystrokes
Installs an hook procedure to monitor for mouse events
Creates a hidden or system file
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

i.imgur.com

ocsp.digicert.com

a.tomx.xyz

How to determine Trojan:Win32/Occamy.CCB?


File Info:
crc32: 00767629
md5: b6f78f144eecce2d1893bde77df8e89e
name: a.v.a_script_by_johnson_chiang.exe
sha1: 59c77c5488937277cea11aba0b73a9f3374d2093
sha256: cb9d37909826f0deb0aae6bcdb100fb9cf1cb09fabb5b5e13c887900305bffaa
sha512: 01c8d4289fdc8fc64d2d985a8c9051958fe3dd3311ad11ba8d1138c94cd3aa774d684a041486786ffdfe44c1033f677a8266817c43905eba58c2e83caf5dcef1
ssdeep: 12288:7iVCROTTFW6VcHsyMzYstvu64GLmLx7/p5n/:7i/hvfyMTvTJCb/
type: MS-DOS executable, MZ for MS-DOS

Version Info:
LegalCopyright: 
InternalName: 
FileVersion: 1.1.28.00
ProductName: 
ProductVersion: 1.1.28.00
FileDescription: 
OriginalFilename: 
Translation: 0x0409 0x04b0

Trojan:Win32/Occamy.CCB also known as:

Bkav	HW32.Packed.
MicroWorld-eScan	Trojan.GenericKD.43386605
FireEye	Generic.mg.b6f78f144eecce2d
McAfee	Artemis!B6F78F144EEC
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
BitDefender	Trojan.GenericKD.43386605
Cybereason	malicious.44eecc
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TROJ_GEN.R03BH0CFR20
Avast	Win32:Malware-gen
GData	Trojan.GenericKD.43386605
Alibaba	TrojanPSW:Application/Generic.2e3d3b49
AegisLab	Trojan.Win32.Strictor.4!c
Rising	Trojan.Zpevdo!8.F912 (CLOUD)
Ad-Aware	Trojan.GenericKD.43386605
Emsisoft	Trojan.GenericKD.43386605 (B)
DrWeb	Trojan.LoadMoney.2856
Trapmine	malicious.moderate.ml.score
APEX	Malicious
Jiangmin	TrojanSpy.AutoHK.v
MaxSecure	Trojan.Malware.73909946.susgen
Arcabit	Trojan.Generic.D29606ED
AhnLab-V3	Malware/Win32.Generic.C2921867
Microsoft	Trojan:Win32/Occamy.CCB
Cynet	Malicious (score: 100)
VBA32	TrojanSpy.AutoHK
ALYac	Trojan.GenericKD.43386605
MAX	malware (ai score=99)
Panda	Trj/CI.A
Tencent	Malware.Win32.Gencirc.114d8149
Yandex	Trojan.LoadMoney!
Fortinet	W32/PWS.Y!tr
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (W)

How to remove Trojan:Win32/Occamy.CCB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan:Win32/Occamy.CCB malicious file