Should I remove “Win32/Spy.CardSpy_AGen.A”?

The Win32/Spy.CardSpy_AGen.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.CardSpy_AGen.A virus can do?

Unconventionial language used in binary resources: Korean
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/Spy.CardSpy_AGen.A?


File Info:
name: FA8D4C7C17DC6273C6A9.mlw
path: /opt/CAPEv2/storage/binaries/8161339ec7d3d7f1a90cfcb0e18ef32895d3632497671dd60ccf7ddcff4ce66f
crc32: 46816910
md5: fa8d4c7c17dc6273c6a92b4a5bde6678
sha1: 6dd00495f77262e17db31cf88689395d61a898b2
sha256: 8161339ec7d3d7f1a90cfcb0e18ef32895d3632497671dd60ccf7ddcff4ce66f
sha512: 29a55c9f833251373336a4f29ed4ed7806e61e0d7db782c7019a70a37e0b96aea4980f5b47e4bf0c3fcea42487c5740d4683315510fcf34d7786d50156f220ee
ssdeep: 3072:R428dRohPO7iACYYqgCRunlBuQx+MWLQtFgO/+ViaHDpD:R4nDGAjgCQlBuWWLMg6+ViWpD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T160343910668080B1E3A91B71456AF6F50A79AE3D13A4E5CFE3787D316E312D35A3728F
sha3_384: 7b5af21fa7c789c84be8540cfa91119a26abfcb780c5462a40cf2b6d35ec679806ee802ce56c5694231414238d5f6982
ep_bytes: e89d640000e979feffff8bff558bec51
timestamp: 2013-09-03 01:49:14

Version Info:
0: [No Data]

Win32/Spy.CardSpy_AGen.A also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.fa8d4c7c17dc6273
McAfee	GenericRXRU-QO!FA8D4C7C17DC
Cylance	unsafe
VIPRE	Trojan.GenericKDZ.96040
Sangfor	Worm.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Spyware ( 0055f2101 )
K7AntiVirus	Spyware ( 0055f2101 )
BitDefenderTheta	Gen:NN.ZexaF.36196.omW@aGg82Fii
Cyren	W32/S-2f42b7bd!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.CardSpy_AGen.A
APEX	Malicious
ClamAV	Win.Malware.Wacatac-9770178-0
Kaspersky	HEUR:Trojan.Win32.Wecod.gen
BitDefender	Trojan.GenericKDZ.96040
MicroWorld-eScan	Trojan.GenericKDZ.96040
Avast	Win32:Evo-gen [Trj]
Tencent	Trojan.Win32.CardSpy.16000130
Emsisoft	Trojan.GenericKDZ.96040 (B)
Baidu	Win32.Trojan.Urelas.d
F-Secure	Trojan.TR/Crypt.XPACK.Gen2
McAfee-GW-Edition	BehavesLike.Win32.Lockbit.dh
Sophos	Troj/Cardspy-G
Ikarus	Trojan.Crypt
GData	Win32.Trojan.PSE.1JQAYT4
Avira	TR/Crypt.XPACK.Gen2
Xcitium	TrojWare.Win32.Zusy.GUP@51x0sc
Arcabit	Trojan.Generic.D17728
ZoneAlarm	HEUR:Trojan.Win32.Wecod.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Backdoor/Win32.Plite.R80332
ALYac	Trojan.GenericKDZ.96040
MAX	malware (ai score=87)
Malwarebytes	CardSpy.Spyware.Stealer.DDS
Rising	Trojan.Generic@AI.100 (RDML:/x9smevlW/1qiuPGrf7meQ)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CardSpy.PRKJ!tr
AVG	Win32:Evo-gen [Trj]
Cybereason	malicious.c17dc6
DeepInstinct	MALICIOUS

How to remove Win32/Spy.CardSpy_AGen.A?

Win32/Spy.CardSpy_AGen.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X