Win32/Spy.FlyStudio.NAH malicious file

The Win32/Spy.FlyStudio.NAH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.FlyStudio.NAH virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/Spy.FlyStudio.NAH?


File Info:
name: 05763B141A9AE7B3AFDB.mlw
path: /opt/CAPEv2/storage/binaries/811930a1d96cc9f1713025821081931c07da982b2a222775cb90910b28f1da60
crc32: 75F8C6FC
md5: 05763b141a9ae7b3afdb848e8d9cf5d0
sha1: 55a004f3afee51ca7b66fb553c1aa3c15f8dcee0
sha256: 811930a1d96cc9f1713025821081931c07da982b2a222775cb90910b28f1da60
sha512: 32713187f4571c1ebe30458936972355b2d93598ab5aa5375427678ab5323a55f7902e24ecf5a9f0f7d65956b3e9738e1d151ab881adf60a3876adfbce9bf4d0
ssdeep: 24576:2ivNm32FNsuNas4EYXfu2/zNmp1SHbm7mCmCX0WIwl:243HYVoeHbm7mCmg0k
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19B656B23A00284A2D5551AB039FB1F79EDB857B10D31DD87E7E4EDB92E32671CA2B01D
sha3_384: 45f28e7329e1cd984e1bdf11a47a09d238098c79271be974ade6445926de660695a4dac75052532765a5104a832706ac
ep_bytes: 558bec6aff6870e95000688cec4c0064
timestamp: 2013-04-28 20:28:14

Version Info:
0: [No Data]

Win32/Spy.FlyStudio.NAH also known as:

Bkav	W32.AIDetectMalware
Skyhigh	BehavesLike.Win32.Generic.tm
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.ins
Cybereason	malicious.3afee5
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.FlyStudio.NAH
APEX	Malicious
Cynet	Malicious (score: 100)
NANO-Antivirus	Trojan.Win32.AVKill.czgiun
Avast	Win32:TrojanX-gen [Trj]
F-Secure	Trojan:W32/DelfInject.R
DrWeb	Trojan.AVKill.30900
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.05763b141a9ae7b3
SentinelOne	Static AI – Malicious PE
Jiangmin	Heur:TrojanSpy/Banker
Google	Detected
Avira	HEUR/AGEN.1340846
Antiy-AVL	Trojan/Win32.FlyStudio.a
Xcitium	Worm.Win32.Dropper.RA@1qraug
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Win32.Trojan.PSE.1CJUYU
Varist	W32/Trojan.CLL.gen!Eldorado
BitDefenderTheta	Gen:NN.ZexaF.36792.DrZ@aa8wBRe
VBA32	BScope.Trojan.Wacatac
Cylance	unsafe
Rising	Stealer.OnlinePay!1.657A (CLASSIC)
Ikarus	Trojan.Win32.Krypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/FlyApplication
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Win32/Spy.FlyStudio.NAH?

Win32/Spy.FlyStudio.NAH removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X