HackTool.AndrewSpecial (file analysis)

The HackTool.AndrewSpecial is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What HackTool.AndrewSpecial virus can do?

Authenticode signature is invalid

How to determine HackTool.AndrewSpecial?


File Info:
name: 43D25F35EBE935E1DC8C.mlw
path: /opt/CAPEv2/storage/binaries/24cb0382a17f3c22f783e0976a08504c24791b3f7bb8cff08cd5c16be8af49cc
crc32: 318CCE1A
md5: 43d25f35ebe935e1dc8c37126975c24c
sha1: 33cf08ccafb1250eb64215563f5b8ca4765d9edc
sha256: 24cb0382a17f3c22f783e0976a08504c24791b3f7bb8cff08cd5c16be8af49cc
sha512: e099f922e72b2e35fa04e8b1bbb20766929eb1ec96406872cd287da78ace385e088a0a8294cf1b4e7b1bfeaa7050abcd75de6fe14dcf3d449290df82d7aa1d63
ssdeep: 3072:lhTkIUsgHXHDLTyuFzcDqj/DiAjBeVKPnQwK0EWdszwQI1E:lhEfXTLD/D3eVcREWduI
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T110A37D0179D0C432D476293548B4DBB08B3EFD301F619EAB67A8167A4F342E19A25DBB
sha3_384: f387553b6fd3eaaac9af86bd8bcb65b4e2a6cdbee7cfaea99bb6950d69bcbbff950927e02fb68be3031ac9d5a4cf9d44
ep_bytes: e898050000e974feffff558bec8b4508
timestamp: 2021-09-29 13:21:58

Version Info:
0: [No Data]

HackTool.AndrewSpecial also known as:

Lionic	Heuristic.File.Generic.00×1!p
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.402478
FireEye	Gen:Variant.Zusy.402478
McAfee	Agent-FOJ!43D25F35EBE9
Malwarebytes	HackTool.AndrewSpecial
VIPRE	Gen:Variant.Zusy.402478
K7AntiVirus	Trojan ( 005748b61 )
Alibaba	Trojan:Win32/HacktoolX.d35bcf8e
K7GW	Trojan ( 005748b61 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Zusy.D6242E
ESET-NOD32	a variant of Win32/Agent.ACOQ
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.MDMP.gen
BitDefender	Gen:Variant.Zusy.402478
Avast	Win32:HacktoolX-gen [Trj]
Tencent	Hacktool.Win32.Agent.c
Ad-Aware	Gen:Variant.Zusy.402478
Sophos	Generic PUA DD (PUA)
Zillya	Trojan.Agent.Win32.2463465
McAfee-GW-Edition	Agent-FOJ!43D25F35EBE9
Trapmine	suspicious.low.ml.score
Emsisoft	Gen:Variant.Zusy.402478 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	HackTool.MiniDmpWrt.b
Avira	TR/Agent.nsemy
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Gen:Variant.Zusy.402478
Google	Detected
AhnLab-V3	Trojan/Win.Trojan-gen.C4662690
BitDefenderTheta	Gen:NN.ZexaF.34698.gqW@a8JziPp
ALYac	Gen:Variant.Zusy.402478
MAX	malware (ai score=86)
VBA32	Trojan.MDMP
Rising	HackTool.AndrewSpecial!1.D1CD (CLASSIC)
Ikarus	Trojan.Win32.Agent
MaxSecure	Trojan.Malware.124150608.susgen
Fortinet	W32/Agent.ACOQ!tr
AVG	Win32:HacktoolX-gen [Trj]
Panda	Trj/GdSda.A

How to remove HackTool.AndrewSpecial?

HackTool.AndrewSpecial removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X