How to remove StripedFly malware

What is StripedFly

StripedFly is a highly sophisticated, cross-platform malware platform that has infected over a million Windows and Linux systems over a span of five years. It was initially misclassified as a Monero cryptocurrency miner, but further investigation revealed its true nature as an advanced persistent threat (APT) malware. StripedFly is a modular framework that can target both Windows and Linux systems. It has a built-in Tor network tunnel for communication with its command-and-control (C&C) server and uses trusted services like Bitbucket, GitLab, and GitHub for update and delivery mechanisms.

The malware operates as a monolithic binary executable with pluggable modules, giving it operational versatility often associated with APT operations. These modules include configuration storage, upgrade/uninstall, reverse proxy, miscellaneous command handler, credential harvester, repeatable tasks, recon module, SSH infector, SMBv1 infector, and a Monero mining module. The presence of the Monero crypto miner is considered a diversion attempt, with the primary objectives of the threat actors being data theft and system exploitation facilitated by the other modules.

How StripedFly infected your system

StripedFly was first discovered after Kaspersky found the platform’s shellcode injected in the WININIT.EXE process, a legitimate Windows OS process. The injected code downloads and executes additional files, such as PowerShell scripts, from legitimate hosting services like Bitbucket, GitHub, and GitLab. Infected devices were likely first breached using a custom EternalBlue SMBv1 exploit that targeted internet-exposed computers.

For persistence on Windows systems, StripedFly adjusts its behavior based on the level of privileges it runs on and the presence of PowerShell. Without PowerShell, it generates a hidden file in the %APPDATA% directory. In cases where PowerShell is available, it executes scripts for creating scheduled tasks or modifying Windows Registry keys. On Linux, the malware assumes the name ‘sd-pam’. It achieves persistence using systemd services, an autostarting .desktop file, or by modifying various profile and startup files.

1. Download StripedFly Removal Tool
2. Use Windows Malicious Software Removal Tool to remove StripedFly
3. Use Autoruns to remove StripedFly
4. Files, folders and registry keys of StripedFly
5. Other aliases of StripedFly
6. How to protect from threats, like StripedFly

Remove StripedFly manually

Upon discovering a Trojan infection like the StripedFly virus on your computer, it’s vital to act swiftly and disconnect your computer from the internet to prevent the malware from communicating with its source. Then, you can run a thorough scan of your system using a trusted antivirus program and isolate or delete the StripedFly virus along with any other identified Trojans. It is also a good idea to change your passwords for online accounts, especially those containing sensitive information, as Trojans can pilfer data.

Manual removal of StripedFly by inexperienced users may become a difficult task because it does not create entries in Add/Remove Programs under Control Panel, does not install browser extensions, and uses random file names. However, there are pre-installed instruments in the Windows system, that allow you to detect and remove malware without using third-party applications. One of them is Windows Malicious Software Removal Tool. It comes with Windows Update in Windows 11, 10, 8. 8.1. For older operating system you can download it here: 64-bit version | 32-bit version.

Remove StripedFly using Windows Malicious Software Removal Tool

1. Type mrt in the search box near Start Menu.
2. Run mrt clicking on found item.
3. Click Next button.
4. Choose one of the scan modes Quick scan, Full scan, Customize scan (Full scan recommended).
5. Click Next button.
6. Click on View detailed results of the scan link to view the scan details.
7. Click Finish button.

Remove StripedFly using Autoruns

StripedFly often sets up to run at Windows startup as an Autorun entry or Scheduled task.

1. Download Autoruns using this link.
2. Extract the archive and run Autoruns.exe file.
3. In Options menu make sure there are checkboxes near Hide Empty Locations, Hide Microsoft Entries, and Hide Windows Entries.
4. Search for suspicious entries with weird names or running from locations like: C:\{username}\AppData\Roaming.
5. Right-click on suspicious entry and choose Delete. This will prevent the threat to run at startup.
6. Switch to Scheduled Tasks tab and do the same.
7. To remove files themselves, click on suspicious entries and choose Jump to Entry…. Remove files or registry keys found.

Remove files, folder, and registry keys of StripedFly

StripedFly files and folders


{randomname}.exe


StripedFly registry keys


no information


Aliases of StripedFly

How to protect from threats, like StripedFly, in future

Standard Windows protection or any decent third-party antivirus (Norton, Avast, Kaspersky) should be able to detect and remove StripedFly. However, if you got infected with StripedFly with existing and updated security software, you may consider changing it. To feel safe and protect your PC from StripedFly on all levels (browser, e-mail attachments, Word or Excel scripts, file system) we recommend a leading provider of internet security solutions – BitDefender. Its solutions both for home and business users proved to be one of the most advanced and effective. Choose and get your BitDefender protection via the button below:

Conclusion

StripedFly is a highly sophisticated malware that has infected over a million systems worldwide. It uses a variety of techniques to infiltrate and persist on infected systems, making it a significant threat to both individual users and organizations. Regularly updating your operating system and antivirus software, exercising caution when downloading files or clicking links, especially from unknown sources, and regularly backing up your data can significantly reduce the risk of future Trojan infections.