BAT/RiskWare.HackTool.WinActivator.E malicious file

The BAT/RiskWare.HackTool.WinActivator.E is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BAT/RiskWare.HackTool.WinActivator.E virus can do?

Executable code extraction
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Reads data out of its own binary image
Drops a binary and executes it
A scripting utility was executed
Uses Windows utilities for basic functionality
Attempts to stop active services
Attempts to repeatedly call a single API many times in order to delay analysis time
Network activity detected but not expressed in API logs
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine BAT/RiskWare.HackTool.WinActivator.E?


File Info:
crc32: DDF7C321
md5: d579a5a83dd5e7d72f89c6fcf84c75e8
name: D579A5A83DD5E7D72F89C6FCF84C75E8.mlw
sha1: 219c4f51eaf6b261cfb35002f47b38401551111e
sha256: 881757023db7903c3ef11df05b3d3e43b2d0639e8af58c1f2f674534b6c8b6eb
sha512: 28c0fe03f14f6c863f760fc3e3d6001d76c2ca4277347ba56e5a4ff5dd0a1afe6cadffba41b9c74533d0454a0a1b3077df467354d4f917edeb9f2c6a43855d93
ssdeep: 12288:GYQyrJBB4en7pIuFzSiH1kLJGdYblNiO+:GYlJBB4e7p1zcPiO+
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

BAT/RiskWare.HackTool.WinActivator.E also known as:

Elastic	malicious (high confidence)
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_60% (W)
K7GW	Trojan ( 0057d7cc1 )
K7AntiVirus	Trojan ( 0057d7cc1 )
ESET-NOD32	BAT/RiskWare.HackTool.WinActivator.E
APEX	Malicious
Avast	FileRepMetagen [Malware]
Cynet	Malicious (score: 100)
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
FireEye	Generic.mg.d579a5a83dd5e7d7
SentinelOne	Static AI – Malicious PE
Microsoft	Trojan:Win32/Wacatac.B!ml
McAfee	Artemis!D579A5A83DD5
VBA32	BScope.Trojan.MulDrop
TrendMicro-HouseCall	TROJ_GEN.R002H06J321
Ikarus	PUA.Generic
Fortinet	Riskware/HackTool_WinActivator
AVG	FileRepMetagen [Malware]
Paloalto	generic.ml

How to remove BAT/RiskWare.HackTool.WinActivator.E?

BAT/RiskWare.HackTool.WinActivator.E removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

BAT/RiskWare.HackTool.WinActivator.E malicious file