HackTool:Win32/CobaltStrike!pz malicious file

The HackTool:Win32/CobaltStrike!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What HackTool:Win32/CobaltStrike!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine HackTool:Win32/CobaltStrike!pz?


File Info:
name: 12F16C43E86971DD04C1.mlw
path: /opt/CAPEv2/storage/binaries/6fd83922e234e0841c7b2196904fe047ad6c47f6250abddcc0953422e94d5d9d
crc32: 6B679286
md5: 12f16c43e86971dd04c1c2132054c402
sha1: a70c3803df60cede496b55109d7739aa863d51c1
sha256: 6fd83922e234e0841c7b2196904fe047ad6c47f6250abddcc0953422e94d5d9d
sha512: e520945b57146f4895271ccbbe9bb786ed1dd223ccefdc9640d9227af7d0769092446b2c0572d52e32048561d4c69b765d7c207717a836e9b32897b1a3855b68
ssdeep: 24576:vBWelxqsfNMNr79DsIZcGf3ggHFlyyJ4kmCahuGUDRNr+mvQWwTOhmU9zIiuXlR+:8F/Y2jSzUxmlOP1
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13D7523169E7E497FCB6D1238087F0B9F73956E805218A6C7A6DB6CD2C24F996103327C
sha3_384: da176192e0ad3cc4c07875a4fea9a57a39f59ec8c521c6e2659f2c7885a3028f939ad5e28c5455d5f787e45a0846d139
ep_bytes: 7a59766e70706c5661645848556b7258
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

HackTool:Win32/CobaltStrike!pz also known as:

Bkav	W32.AIDetectMalware
Skyhigh	BehavesLike.Win32.Generic.tm
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
Symantec	Packed.Generic.551
Elastic	malicious (moderate confidence)
Cynet	Malicious (score: 100)
ClamAV	Win.Trojan.Banload-9853585-0
NANO-Antivirus	Trojan.Win32.Miner.jeccbt
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Sophos	Troj/Miner-ABM
DrWeb	Trojan.PWS.Banker1.30278
Ikarus	Trojan.Win64.CoinMiner
Varist	W32/S-8f4e9221!Eldorado
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	malware.kb.a.994
Xcitium	TrojWare.Win32.TrojanDownloader.Banload.RES@8hfp75
Microsoft	HackTool:Win32/CobaltStrike!pz
GData	Win32.Trojan.Agent.AP8TXO
Google	Detected
AhnLab-V3	Trojan/Win32.Banload.C3470781
Acronis	suspicious
VBA32	TrojanPSW.Banker
Rising	Trojan.Vindor!8.10CC (RDMK:cmRtazp8s+EWeEFAjF6tX6atT+Az)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Banload.BD2A!tr

How to remove HackTool:Win32/CobaltStrike!pz?

HackTool:Win32/CobaltStrike!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X