HackTool:Win32/CobaltStrike!pz removal instruction

The HackTool:Win32/CobaltStrike!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What HackTool:Win32/CobaltStrike!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Binary file triggered YARA rule

How to determine HackTool:Win32/CobaltStrike!pz?


File Info:
name: 79BE11B05081890F77E1.mlw
path: /opt/CAPEv2/storage/binaries/68843cb55034bc1d3f61d1b27220af8b263869aacf460d376399abcbca458504
crc32: 056F60BB
md5: 79be11b05081890f77e1aea460ae987a
sha1: 5dd438a40acbd442ee4037318960f12f2d878077
sha256: 68843cb55034bc1d3f61d1b27220af8b263869aacf460d376399abcbca458504
sha512: 938b4a107d8ed833b12eeadaeb2f31ac7c61b1a8097c34c98ae7c57830da606d35975ca86f503eb326963043a8cfb02bcf89f00fef6c818ffd36f5a42b72bdc7
ssdeep: 24576:vBF6727f8UhNnXIhz24GtdR4a/f5kwjnxw5A92LrnG4295G:rUUvXjVTRdf5k0whLqTG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T183351290CE6B14F9D60B5074506FAB3FA62226090F38ECCBC3C41D8AE66BFF51536566
sha3_384: 6ebc356e5001267c9bf3cd37f7604a991222ef917382a19ce6f3fee2451a1fcf9075e42f70d109e8663d1a9bb1af3954
ep_bytes: 627755446b486a5a566550484e594248
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

HackTool:Win32/CobaltStrike!pz also known as:

Bkav	W32.AIDetectMalware
DrWeb	Trojan.PWS.Banker1.30278
MicroWorld-eScan	Gen:Variant.Ulise.474641
FireEye	Generic.mg.79be11b05081890f
Skyhigh	BehavesLike.Win32.Generic.th
McAfee	GenericRXNR-AT!79BE11B05081
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Ulise.474641
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Symantec	Packed.Generic.551
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Razy-7332608-0
BitDefender	Gen:Variant.Ulise.474641
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Rising	HackTool.CobaltStrike!8.1216E (TFE:3:9ER1rxEHsoO)
Emsisoft	Gen:Variant.Ulise.474641 (B)
Sophos	Troj/Miner-ABH
Ikarus	Trojan.Win64.CoinMiner
Google	Detected
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	malware.kb.a.969
Microsoft	HackTool:Win32/CobaltStrike!pz
Xcitium	TrojWare.Win32.TrojanDownloader.Banload.RES@8hfp75
Arcabit	Trojan.Ulise.D73E11
GData	Gen:Variant.Ulise.474641
Varist	W32/S-8f4e9221!Eldorado
AhnLab-V3	Trojan/Win32.Banload.C3470781
Acronis	suspicious
ALYac	Gen:Variant.Ulise.474641
VBA32	TrojanPSW.Banker
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Agent.7267!tr
DeepInstinct	MALICIOUS
alibabacloud	Trojan:Win/CoinMiner.UXW

How to remove HackTool:Win32/CobaltStrike!pz?

HackTool:Win32/CobaltStrike!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X