HackTool:Win32/CobaltStrike!pz removal tips

The HackTool:Win32/CobaltStrike!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What HackTool:Win32/CobaltStrike!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Binary file triggered YARA rule

How to determine HackTool:Win32/CobaltStrike!pz?


File Info:
name: B1069D1FD5403F532768.mlw
path: /opt/CAPEv2/storage/binaries/6b667dc837d001d17461bb8ef5d94a2d06aeb7c2b52035b6d0bab04a1e82fd8e
crc32: E1B155AD
md5: b1069d1fd5403f53276885ebcb516468
sha1: f636af903c3db7e5b9366131213cd2a72a5b396e
sha256: 6b667dc837d001d17461bb8ef5d94a2d06aeb7c2b52035b6d0bab04a1e82fd8e
sha512: 2cd7b51be15ebb1275a12271f714fd85d99432ee0357f4cb3ae12feded76814e4b4dc07ac6167819d45710e9cc78f653a7927f0882005d3ee787ff2ef088c933
ssdeep: 12288:wqBF6oVTk26G+Cr8WCKM66UMe6TlaY3WbohCgGOL28IUgyPlzGZwGwQSvCEoFOKO:vBF6727vrNaT/QoKWgytS4vL77lqU0PY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11D15F181CDAB90F9D60B6630645BA63F662217451F38DCDBC3D40D9AE267FF110329BA
sha3_384: 31ac8a14c98f6e021812a9e66f240bc9df619c43c915a202aabdaf4adfdb9b67f6768cbdf643aff41a6fb71afefc21e2
ep_bytes: 4b4d4553786f65557056674661577a70
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

HackTool:Win32/CobaltStrike!pz also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (moderate confidence)
DrWeb	Trojan.PWS.Banker1.30278
FireEye	Generic.mg.b1069d1fd5403f53
Skyhigh	BehavesLike.Win32.Generic.ch
McAfee	GenericRXNR-AT!B1069D1FD540
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Trojan.Win32.Save.a
Symantec	Packed.Generic.551
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Eati-7331639-0
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Sophos	Troj/Miner-ABH
Ikarus	Trojan.Win64.CoinMiner
Google	Detected
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	malware.kb.a.966
Xcitium	TrojWare.Win32.TrojanDownloader.Banload.RES@8hfp75
Microsoft	HackTool:Win32/CobaltStrike!pz
Varist	W32/S-8f4e9221!Eldorado
AhnLab-V3	Trojan/Win32.Banload.C3470781
Acronis	suspicious
VBA32	TrojanPSW.Banker
Rising	HackTool.CobaltStrike!8.1216E (TFE:4:4BhO8kfUKzS)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.7267!tr
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)
alibabacloud	Trojan:Win/CoinMiner.UXW

How to remove HackTool:Win32/CobaltStrike!pz?

HackTool:Win32/CobaltStrike!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X