Trojan:Win32/Occamy.C (Occamy Trojan)

Written by Robert Bailey

What is Trojan:Win32/Occamy.C infection?

In this short article you will certainly find regarding the meaning of Trojan:Win32/Occamy.C as well as its unfavorable influence on your computer. This virus can correctly be classified as hacktool – a program which is designed and used to break different security elements of an operating system.

Robert Bailey
Robert Bailey
IT Security Expert

It is better to prevent, than repair and repent!

When we talk about the intrusion of unfamiliar programs into your computer’s work, the proverb “Forewarned is forearmed” describes the situation as accurately as possible. Gridinsoft Anti-Malware is exactly the tool that is always useful to have in your armory: fast, efficient, up-to-date. It is appropriate to use it as an emergency help at the slightest suspicion of infection.
Gridinsoft Anti-Malware 6-day trial available.
EULA | Privacy Policy | Gridinsoft

@topcybersecuritySubscribe to our Telegram channel to be the first to know about news and our exclusive materials on information security.

In the majority of the instances, Trojan:Win32/Occamy.C hacktool will not show any signs of its presence. However, the user may notice the changes in the components he uses every day because this virus can’t make everything quiet.

NameOccamy trojan
Threat TypeTrojan Downloader, Troajn Password Stealer, Banking Trojan, Spyware
SymptomsDesigned to stealthily infiltrate victim’s computer and remain silent thus no particular symptoms are clearly visible on an infected PC.
DistributionEmail attachments, malicious online advertisements, social engineering, torrents, cracks.
RisksStolen banking information, passwords, identity theft, victim’s computer added to a botnet.

Trojan:Win32/Occamy.C Summary

These modifications can be as adheres to:

  • Executable code extraction. Cybercriminals often use binary packers to hinder the malicious code from reverse-engineered by malware analysts. A packer is a tool that compresses, encrypts, and modifies a malicious file’s format. Sometimes packers can be used for legitimate ends, for example, to protect a program against cracking or copying.
  • Creates RWX memory. There is a security trick with memory regions that allows an attacker to fill a buffer with a shellcode and then execute it. Filling a buffer with a shellcode isn’t a big deal. It’s just data. The problem arises when the attacker can control the instruction pointer (EIP), usually by corrupting a function’s stack frame using a stack-based buffer overflow and then changing the flow of execution by assigning this pointer to the address of the shellcode.
  • Network activity detected but not expressed in API logs. Microsoft built an API solution right into its Windows operating system. It reveals network activity for all apps and programs that ran on the computer in the past 30-days. This malware hides network activity.
  • Anomalous binary characteristics. This is a way of hiding virus’ code from antiviruses and virus’ analysts.
Similar behavior
Related domains

Trojan:Win32/Occamy.C distribution ways

The majority of cases of Trojan:Win32/Occamy.C malware delivery goes to these ways:

  • Email spamming or spamming in social networks/communication platforms
  • Usage of unlicensed (hacked) programs or dubious tools
  • Malicious advertisements on the internet (ads with a malicious link or file inside)
  • Malicious advertisements on the web, however, is an old-timer of malware distribution. And the advice to stop clicking the blinking advertisements on untrustworthy websites exists as long as the ads on the Internet. You can also install ad-blocking plugins for your web browser – they will deal with any ads. However, if they are generated by adware already present on your PC, ad blockers will be useless.

    Email spamming became a prevalent malware distribution method since the users do not raise suspicion on notifications from DHL or Amazon about the incoming delivery. However, it is quite easy to distinguish the malevolent email from the original one. One which is sent by cybercriminals has a strange sender address – something like Simultaneously, the original email address has a specific domain name ( or and can also be seen on the official website in the “Contact us” tab.

    Software bundling is a widespread practice among the virus developers. Users who hack the programs to make them usable without purchasing a license approve any offer to include another program in the pack because they are gaining money in such a way. Check precisely the installation window for signs like “Advanced installation settings” or so. The ability to switch off the malware installation often hides under such items.

    Effects of Trojan:Win32/Occamy.C activity.

    In different edges of the world, victims of the Backdoor:Win32/Bladabindi!ml say about different signs of virus activity. Nonetheless, the common sign that your PC was attacked by a hack tool is disabling the security mechanisms (passwords) in the major system elements.

    Ransomware injection

    Changes that Trojan makes:Win32/Occamy.C activity virus are next:

    Disabling the Windows Defender. An embedded anti-malware solution from Microsoft is a favorite target of malware creators. And since it is so easy to disable through Group Policies, every second trojan virus makes this action. Trojan:Win32/Occamy.C activity is not an exception. After that step, you will not get a notification about the detected malware.

    Making several complicated manipulations with the system security settings. The virus disables a visible security mechanism and turns off the methods used by the system to prevent malware execution. Under this term, I mean the forbid to launch the VBS scripts, disabled by default MS Office macroses or remote registry editing facilities.

    Password extraction. Users who make use of a local Windows account may lose their credentials. The local account password is stored in a separate area of the Winlogon process in encrypted form. The virus may easily call the decrypt function and get the password of your account, as well as passwords of all users of your PC and local network.

    Technical details

    File Info:

    crc32: 433A57A0
    md5: e3648731a36105980f5fae6b4afe614b
    name: officeupd.fft
    sha1: 85db743d14fbd83f893ec34dbdf57d0344e16156
    sha256: 877c735650488f81807239a0ca564c8faa660a8c9141a9aba2049b9fe1d5b2fb
    sha512: dcf4742b7c059f4580d9bbee1c5e444eb37bc1ab4c183bb7697ac33cc8d74a2d2ad9016ba1dc6429deb31d7fc1cd101d3544806411682d49147b4fc08b0eea2f
    ssdeep: 12288:3qhfOhBJUmIa4cQ5VSdQpRSZZLPwPqnk7HLhPQ9dLz6D:I9dXrEEw/PwP4k71I9dLz6D
    type: PE32 executable (GUI) Intel 80386, for MS Windows

    Version Info:

    0: [No Data]

    Trojan:Win32/Occamy.C also known as:

    K7AntiVirusTrojan ( 0055c6211 )
    K7GWTrojan ( 0055c6211 )
    RisingTrojan.Generic@ML.93 (RDMK:rUN0MZOa0Bol/tTHexDcew)
    Endgamemalicious (high confidence)
    MAXmalware (ai score=85)
    ESET-NOD32a variant of Win32/Kryptik.GYWN
    SentinelOneDFI – Malicious PE
    CrowdStrikewin/malicious_confidence_100% (W)

    How to remove Trojan:Win32/Occamy.C virus?

    Unwanted application has ofter come with other viruses and spyware. This threats can steal account credentials, or crypt your documents for ransom.
    Reasons why I would recommend GridinSoft1

    The is an excellent way to deal with recognizing and removing threats – using Gridinsoft Anti-Malware. This program will scan your PC, find and neutralize all suspicious processes.2.

    Download GridinSoft Anti-Malware.

    You can download GridinSoft Anti-Malware by clicking the button below:

    Run the setup file.

    When the setup file has finished downloading, double-click on the install-antimalware-fix.exe file to install GridinSoft Anti-Malware on your system.

    Run Setup.exe

    An User Account Control asking you about to allow GridinSoft Anti-Malware to make changes to your device. So, you should click “Yes” to continue with the installation.

    GridinSoft Anti-Malware Setup

    Press “Install” button.

    GridinSoft Anti-Malware Install

    Once installed, Anti-Malware will automatically run.

    GridinSoft Anti-Malware Splash-Screen

    Wait for the Anti-Malware scan to complete.

    GridinSoft Anti-Malware will automatically start scanning your system for Trojan:Win32/Occamy.C files and other malicious programs. This process can take 20-30 minutes, so I suggest you periodically check on the status of the scan process.

    GridinSoft Anti-Malware Scanning

    Click on “Clean Now”.

    When the scan has finished, you will see the list of infections that GridinSoft Anti-Malware has detected. To remove them click on the “Clean Now” button in the right corner.

    GridinSoft Anti-Malware Scan Result

    Are Your Protected?

    GridinSoft Anti-Malware will scan and clean your PC for free in the trial period. The free version offers real-time protection for the first 2 days. If you want to be fully protected at all times – I can recommend you to purchase a full version:

    Full version of GridinSoft

    Full version of GridinSoft Anti-Malware

    If the guide doesn’t help you remove Trojan:Win32/Occamy.C, you can always ask me in the comments to get help.

    User Review
    0 (0 votes)
    Comments Rating 0 (0 reviews)


    1. GridinSoft Anti-Malware Review from HowToFix site:
    2. More information about GridinSoft products:

    About the author

    Robert Bailey

    Security Engineer. Interested in malware, reverse engineering, white ethical hacking. I like coding, travelling and bikes.

    Leave a Reply


    This site uses Akismet to reduce spam. Learn how your comment data is processed.