Trojan.FlyStudio.CA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 4,447 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 16,879 |
| First Seen: | December 17, 2012 |
| Last Seen: | July 14, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.FlyStudio.CA on your system indicates a potential security threat that requires immediate attention. This Trojan-type threat can compromise your computer's security and put your personal data at risk. In this removal report, we will provide you with general guidance on how to remove Trojan.FlyStudio.CA and prevent future infections.
Table of Contents
What Is Trojan.FlyStudio.CA?
Trojan.FlyStudio.CA is a type of malware that can infect your computer without your knowledge or consent. Trojans are known for their ability to disguise themselves as legitimate programs, making them difficult to detect. Once installed, they can allow unauthorized access to your system, steal sensitive information, and disrupt your computer's normal functioning.
How Trojan.FlyStudio.CA Operates
Trojan.FlyStudio.CA, like other Trojans, operates by exploiting vulnerabilities in your system or deceiving you into installing it. It can spread through various means, including malicious downloads, infected email attachments, or compromised websites. Once inside your system, it can create backdoors for remote access, allowing hackers to control your computer, steal data, or install additional malware.
Symptoms of Infection
Identifying a Trojan infection can be challenging, but there are several symptoms you should look out for. These include unexpected changes to your system settings, unfamiliar programs or icons, slow system performance, frequent crashes, or unusual network activity. If you notice any of these symptoms, it's essential to take immediate action to secure your system and remove the threat.
- Unexplained changes to your system settings or browser configuration
- Appearance of unfamiliar programs or icons on your desktop or in your system tray
- Significant decrease in system performance or frequent crashes
- Unusual network activity, such as unexpected data transfers or unfamiliar connections
How to Remove Trojan.FlyStudio.CA
- Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for internet access to download removal tools.
- Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove all instances of Trojan.FlyStudio.CA.
- Uninstall any suspicious programs that you don't recognize or that were installed around the time the malware was detected.
- Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any malicious extensions or settings changes made by the Trojan.
- Reboot your computer and perform another full scan with your anti-malware tool to ensure that all remnants of the malware have been removed.
Conclusion
Removing Trojan.FlyStudio.CA requires a combination of safe computing practices, the use of reputable anti-malware tools, and careful system cleaning. By following the steps outlined in this report, you can effectively remove the threat and protect your system from future infections. Remember, prevention is key; always be cautious when downloading software, opening email attachments, or clicking on links from unknown sources. Regularly updating your operating system, browser, and security software can also help protect against the latest threats.
Analysis Report
General information
| Family Name: | Trojan.FlyStudio.CA |
|---|---|
| Packers: | UPX |
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
400fb8b35365d7e45eaab87dee5999a5
SHA1:
f8989a08ba5e7d005611867ebdd53fd305dc9d39
SHA256:
B797863867A9A17432CD9E8EAE80AD346213C5231741304FB8F6226BBA12733E
File Size:
262.14 KB, 262144 bytes
|
|
MD5:
d41712682394c7f20e030a4fed82b550
SHA1:
d2ba65474c17045b40ad3904112b5b10dd9dbbf8
SHA256:
4C29AE768BAA83B876839704DE85B7295F2A2C2A36D33201C1026C269C667C8E
File Size:
4.27 MB, 4268406 bytes
|
|
MD5:
c0cbc4af510a67e80faf6c515f1ea838
SHA1:
12667e9763f4432e36bbffed1bd87b61ca61bfeb
SHA256:
406005B78ACA73E3F719DF7747C9A1BB7D8888EC987498CB3C221671CA942F89
File Size:
761.86 KB, 761856 bytes
|
|
MD5:
d2736599fe4310c08f6c5aa52e3ac2e3
SHA1:
c050ee32d23d6f713ac0188015ae59aa1f8be2ce
SHA256:
7AA5045B2F5CDD227B73FBCD37A6C55B94580A2A30BE4E7C4448C3F17ADDE688
File Size:
4.55 MB, 4550656 bytes
|
|
MD5:
9de32c22665073500819587fa7e5f850
SHA1:
4f1b36c02026b13ca5da0578de75a7df13d03709
SHA256:
9FDD27F388521BF3F3670B636E9F4E699D42B5BAF2FBAF03F1DB5D0D6D78F0A2
File Size:
221.18 KB, 221184 bytes
|
Show More
|
MD5:
46589c5c492f0bd050a34f800a5704b4
SHA1:
08f0e909a8e5924037d3a9b91422b962fc02bab9
SHA256:
089352EECE1CB1CA4C8511C6611770D4B1C808680FA53FDDC3B683AE826905C3
File Size:
1.66 MB, 1658880 bytes
|
|
MD5:
f275e33847cd325a4775edd19ed11881
SHA1:
35c05f593963ae60354f3469df1145c1a1713055
SHA256:
EB7A38ED3CF137B4B15D5D8E714CDD3111069216E1783A6F19F6E4ABF0B5E0DC
File Size:
847.87 KB, 847872 bytes
|
|
MD5:
cc6f5e8389693cd09fc401765e1c836b
SHA1:
a1cd5f3af5a60efca41b54ffb63b98427c2c1f77
SHA256:
7E582AD016A3906172CE66283707D6B47DA76F92A358E9B5DAE374F0F68A3397
File Size:
1.57 MB, 1568768 bytes
|
|
MD5:
ae1f600fac7b6c3f8591d67d6b529007
SHA1:
3d444f8891a5a00393a9930b388d07e7c6ed8e83
SHA256:
5FBA553471690330A9FADCCF4D46EF6671BFBDA48B469CBA3AF78864DD033069
File Size:
913.41 KB, 913408 bytes
|
|
MD5:
89d2ebdd72bc2bb8877c5a56074dd1c6
SHA1:
c7e1bfa1cb9a79df833fe6140613f0acd54268bb
SHA256:
C6FC3B0B3E54851D2ABEF0B22534EFE031C70BA163F2A13D7B5C2F7B2F04EA1D
File Size:
621.06 KB, 621056 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has exports table
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- big overlay
- dll
- HighEntropy
- MZ (In Overlay)
- No Version Info
- packed
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,536 |
|---|---|
| Potentially Malicious Blocks: | 408 |
| Whitelisted Blocks: | 1,092 |
| Unknown Blocks: | 36 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Bitcoinminer.FD
- FlyStudio.CA
- KeyLogger.B
- Kryptik.DGW
- Kryptik.NRR
Show More
- Lotok.T
- Ramnit.AP
- Trojan.Agent.Gen.AAC
- Trojan.Downloader.Gen.CG
- Trojan.Downloader.Gen.DO
- Trojan.Downloader.Gen.EY
- Trojan.Downloader.Gen.HL
- Trojan.Downloader.Gen.HQ
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Anti Debug |
|
| User Data Access |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f8989a08ba5e7d005611867ebdd53fd305dc9d39_0000262144.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\4f1b36c02026b13ca5da0578de75a7df13d03709_0000221184.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\08f0e909a8e5924037d3a9b91422b962fc02bab9_0001658880.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\3d444f8891a5a00393a9930b388d07e7c6ed8e83_0000913408.,LiQMAxHB
|
