Should I remove “Win32/Spy.Grandoreiro.CA”?

The Win32/Spy.Grandoreiro.CA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.Grandoreiro.CA virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/Spy.Grandoreiro.CA?


File Info:
name: 35C57A0EEFFECB609182.mlw
path: /opt/CAPEv2/storage/binaries/97fd566c25c74082007bcc911ad0fe772066be2f1b2ae64cf055d1a2b24cfc9f
crc32: EBA22A84
md5: 35c57a0eeffecb6091827c77c177480a
sha1: 43e560d7b5cb03d431bcd32c2da84d5fcf9c95f7
sha256: 97fd566c25c74082007bcc911ad0fe772066be2f1b2ae64cf055d1a2b24cfc9f
sha512: fd4f11d156de226a0dc9fc61dc0376a6c7404c0f4a61ec8d880ccda7e2ef676eb1e7e72334a49d027d98dd69ea40238456832e935ce083f36b538d28d06a359a
ssdeep: 49152:QSPT1tqDy9YZTSq0Faqs/DP3rLXSHQQZO6nbLEhPIL+dRiQz5AdvhkWj:p5tWyGrP3rLXSVbLEhPE6
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T184466C23FB48A53EC45B1B3A0877A2149D3F7AB139528D5777F4089C8E365803E3A65B
sha3_384: ba6993ee7b7e97f8cb3831bc74b56ebbd5ee00b4de50857dd8d9b12b42889d64d7c688ccc95be63f738d5ad2778a0ae3
ep_bytes: 558bec83c4c0b8680c8900e8ac08b7ff
timestamp: 2024-01-04 19:17:52

Version Info:
0: [No Data]

Win32/Spy.Grandoreiro.CA also known as:

Bkav	W32.Common.71C51356
Lionic	Trojan.Win32.Grandoreiro.7!c
AVG	Win32:SpywareX-gen [Trj]
MicroWorld-eScan	Gen:Variant.Barys.412050
FireEye	Gen:Variant.Barys.412050
Skyhigh	BehavesLike.Win32.BadFile.th
ALYac	Gen:Variant.Barys.412050
Cylance	unsafe
Zillya	Trojan.Grandoreiro.Win32.2788
Sangfor	Spyware.Win32.Grandoreiro.Vxcy
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanBanker:Win32/Grandoreiro.5281caee
K7GW	Spyware ( 005a3f4a1 )
K7AntiVirus	Spyware ( 005a3f4a1 )
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.Grandoreiro.CA
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan-Banker.Win32.Grandoreiro.gen
BitDefender	Gen:Variant.Barys.412050
Avast	Win32:SpywareX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13fbed57
Emsisoft	Gen:Variant.Barys.412050 (B)
F-Secure	Heuristic.HEUR/AGEN.1364204
VIPRE	Gen:Variant.Barys.412050
TrendMicro	TROJ_GEN.R002C0XA524
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Win32.Grandoreiro
Avira	HEUR/AGEN.1364204
Antiy-AVL	Trojan[Spy]/Win32.Grandoreiro
Kingsoft	Win32.Trojan-Banker.Grandoreiro.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Barys.D64992
ZoneAlarm	UDS:Trojan-Banker.Win32.Grandoreiro.gen
GData	Gen:Variant.Barys.412050
Google	Detected
AhnLab-V3	Malware/Win.Generic.C5570766
McAfee	Artemis!35C57A0EEFFE
MAX	malware (ai score=86)
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002C0XA524
Rising	Spyware.Grandoreiro!8.F2CC (TFE:6:HMeus8CT5pN)
MaxSecure	Trojan.Malware.102062852.susgen
Fortinet	W32/Grandoreiro.CB!tr.spy
DeepInstinct	MALICIOUS

How to remove Win32/Spy.Grandoreiro.CA?

Win32/Spy.Grandoreiro.CA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X