HackTool:Win32/CobaltStrike!pz malicious file

The HackTool:Win32/CobaltStrike!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What HackTool:Win32/CobaltStrike!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine HackTool:Win32/CobaltStrike!pz?


File Info:
name: 0C0A9B5D73A1F283C5F0.mlw
path: /opt/CAPEv2/storage/binaries/49153f0923f52a4e8f1055527db4969632f977c6b3e22adfc8ca31470bcfcf1f
crc32: BB737D37
md5: 0c0a9b5d73a1f283c5f0677a69aba8da
sha1: a4f652b163619c0045fd683838ea3fe6af60437f
sha256: 49153f0923f52a4e8f1055527db4969632f977c6b3e22adfc8ca31470bcfcf1f
sha512: 116c5131c7dbed679f79c3915daebd2065c1b75f8685eed001fd65793620ac7af45c03ae4ffe1606f9083da3b8845c8aec6ce5a88a666e02b9788723086e0966
ssdeep: 12288:wqBF6oVTk26G+Cr8WCKM66UMe6TlaY3WvCFdDQSMm+utvSYOE88uEfdKCrUhzvy:vBF6727vrNaT/6CFdDQ3m+uUWKAAvy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1ECE4F195CDAF50F5D60BA170A46BA73F562227091F38DDCBC7C40E46D26ABF1203297A
sha3_384: 47c6129bf2da583185d73812977fee91628c2371634513a4b7884c3b631f421af9cc922f8df4a7d876e2458daf282b7a
ep_bytes: 4b4d4553786f65557056674661577a70
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

HackTool:Win32/CobaltStrike!pz also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (moderate confidence)
DrWeb	Trojan.PWS.Banker1.30278
ClamAV	Win.Malware.Eati-7331497-0
FireEye	Generic.mg.0c0a9b5d73a1f283
Skyhigh	BehavesLike.Win32.Generic.jh
McAfee	GenericRXNR-AT!0C0A9B5D73A1
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	HackTool:Win32/CobaltStrike.495a28d2
Symantec	Packed.Generic.551
APEX	Malicious
Cynet	Malicious (score: 100)
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Rising	HackTool.CobaltStrike!8.1216E (TFE:4:4BhO8kfUKzS)
Sophos	Troj/Miner-ABH
Ikarus	Trojan.Win64.CoinMiner
GData	Win32.Trojan.Agent.GTMH2A
Google	Detected
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	malware.kb.a.965
Xcitium	TrojWare.Win32.TrojanDownloader.Banload.RES@8hfp75
Microsoft	HackTool:Win32/CobaltStrike!pz
Varist	W32/S-8f4e9221!Eldorado
AhnLab-V3	Trojan/Win32.Banload.C3470781
Acronis	suspicious
VBA32	TrojanPSW.Banker
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Agent.7267!tr
DeepInstinct	MALICIOUS

How to remove HackTool:Win32/CobaltStrike!pz?

HackTool:Win32/CobaltStrike!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X