HackTool:Win32/ProcHack.SGA!MTB removal

The HackTool:Win32/ProcHack.SGA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What HackTool:Win32/ProcHack.SGA!MTB virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid

How to determine HackTool:Win32/ProcHack.SGA!MTB?


File Info:
name: 24A656421D233ADCB130.mlw
path: /opt/CAPEv2/storage/binaries/39fb7426ed59fa14eb37dd68505b4a4fb530501fa2050287b61270bbd20c20d7
crc32: 4A3D540D
md5: 24a656421d233adcb13074b73fbca43e
sha1: 592d81ac29470b45030c111464b6dbea3cc87e2c
sha256: 39fb7426ed59fa14eb37dd68505b4a4fb530501fa2050287b61270bbd20c20d7
sha512: 726c56a0f985c475cb2adbee3d5d98eea0f5b85a95b6be4d8a956fc840ab1615e0ecbcd28848bce655683d10173f158ac988b0c9e4ffc6f27e7a485eb3425ce5
ssdeep: 24576:ViWqQ/EbE313Jylwv+K44UFonLBKMcwG3F:VZF3Ja6KAwHwu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T174458D12F7B3C0F2D645153006E77735AAB6DA860F228F97E7A4DD796C32280963722D
sha3_384: 8b20b0d6faac2e076bad5c5779ee68435038637ecb8efcd56006ec84a254c3551f10cd25423a1e496021ae018d74f251
ep_bytes: 558bec6aff68a8fd4e0068d43c4a0064
timestamp: 2012-03-21 15:38:40

Version Info:
FileVersion: 1.0.0.0
FileDescription: 易语言程序
ProductName: 易语言程序
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
Translation: 0x0804 0x04b0

HackTool:Win32/ProcHack.SGA!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Rootkit.5!c
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Zusy.484862
FireEye	Generic.mg.24a656421d233adc
Skyhigh	BehavesLike.Win32.Generic.th
McAfee	Artemis!24A656421D23
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 005246d51 )
Alibaba	RiskWare:Win32/FlyStudio.9a1b9757
K7GW	Trojan ( 005246d51 )
CrowdStrike	win/malicious_confidence_60% (D)
Arcabit	Trojan.Zusy.D765FE
BitDefenderTheta	Gen:NN.ZexaF.36608.ir0@a8TvINjH
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/FlyStudio.HackTool.A potentially unwanted
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Procpatcher-9875517-0
Kaspersky	UDS:Rootkit.Win32.Agent.elxy
BitDefender	Gen:Variant.Zusy.484862
Avast	Win32:MiscX-gen [PUP]
Tencent	Malware.Win32.Gencirc.13f04955
Emsisoft	Application.Generic (A)
Baidu	Win32.Rootkit.Agent.f
F-Secure	Trojan:W32/DelfInject.R
DrWeb	Trojan.NtRootKit.18405
VIPRE	Gen:Variant.Zusy.484862
TrendMicro	TROJ_GEN.R002C0WIN23
Trapmine	malicious.moderate.ml.score
Sophos	Generic Reputation PUA (PUA)
Ikarus	Trojan-PSW.QQTen
Varist	W32/Trojan.GRW.gen!Eldorado
Avira	RKIT/Agent.qkmkt
Antiy-AVL	Trojan/Win32.FlyStudio.a
Kingsoft	malware.kb.a.1000
Xcitium	TrojWare.Win32.Agent.OSCF@5rs7jr
Microsoft	HackTool:Win32/ProcHack.SGA!MTB
ZoneAlarm	UDS:Rootkit.Win32.Agent.elxy
GData	Win32.Trojan.FlyStudio.I
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5494374
VBA32	Rootkit.Gen.2
ALYac	Gen:Variant.Zusy.484862
MAX	malware (ai score=87)
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0WIN23
Rising	Rootkit.Agent!1.6784 (CLASSIC)
SentinelOne	Static AI – Malicious PE
MaxSecure	Dropper.Dinwod.frindll
Fortinet	W32/CoinMiner.PHP!tr
AVG	Win32:MiscX-gen [PUP]
Cybereason	malicious.c29470
DeepInstinct	MALICIOUS

How to remove HackTool:Win32/ProcHack.SGA!MTB?

HackTool:Win32/ProcHack.SGA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X