What is “Trojan:Win32/Spy!pz”?

The Trojan:Win32/Spy!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Spy!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the embedded pe malware family
• Binary file triggered YARA rule
• Attempts to modify proxy settings
• Deletes executed files from disk
• Attempts to access Bitcoin/ALTCoin wallets
• Touches a file containing cookies, possibly for information gathering
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Spy!pz?

File Info:
name: E016AA16DAE9761BCAEA.mlw
path: /opt/CAPEv2/storage/binaries/9bde87483a40c05b178fc40941f2411d664835d4cc812855ed301f9b2993ba5f
crc32: 1EC87CC7
md5: e016aa16dae9761bcaea0e682760edce
sha1: d0aa550f27d19f3812137dac37967292705b4e63
sha256: 9bde87483a40c05b178fc40941f2411d664835d4cc812855ed301f9b2993ba5f
sha512: d6b64fe89b78a3c782cdcb017735164911ee564a016f6ded7682d6abdfac94ca735b7964478e0b7660ad2dfeda1e1f3ee23592263706547f18cf236b30215b68
ssdeep: 6144:3YASJKenie2xT2NU2OTFQb8Fb0IQUfFmn:3k5nilTFQbI0v+o
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B034F12ED6137AC5C62CBA7C14F32B7C9E47102B177807251B8BD60DEA982B17F97208
sha3_384: 5e14fab3e4126830598084dfb6a5d15a18de23e212f5bfc41d49e2d0e633844448159a257e702e70b53aca8d48c62b7e
ep_bytes: 558bec81ec040100006a01ff15904040
timestamp: 2015-09-01 08:30:23

Version Info:
0: [No Data]

Trojan:Win32/Spy!pz also known as:

How to remove Trojan:Win32/Spy!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.