PUA

NSIS:Downloader-AAT [PUP] removal instruction

Malware Removal

The NSIS:Downloader-AAT [PUP] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What NSIS:Downloader-AAT [PUP] virus can do?

  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Reads data out of its own binary image
  • Drops a binary and executes it

Related domains:

z.whorecord.xyz
a.tomx.xyz
pe-mik.net
pe-ma3i.info
pe-err.com

How to determine NSIS:Downloader-AAT [PUP]?


File Info:

crc32: 39F7141B
md5: da13113783a8674c92a94573a164ab9e
name: DA13113783A8674C92A94573A164AB9E.mlw
sha1: e14b5c3a761b848a0577f95f5567819254f2d342
sha256: df7049b8c4d704376be3920232b1ba6b2c8cf2ff0f9cf3bf22f6d89c1c9515dc
sha512: 7756180103ba013edebfacc9c9bcd98a7a34072a3f82d04dbcf5e863c0f3de56ba58a55b68b688108c81899d6e83e0ddb6a493d28436b1c6c059544dd72162e4
ssdeep: 49152:h+/pCDxgkOiRQyX8g8cSvNo5MJpvFNjrT8wplb6rXrI:h+/1hiR9sVcSyypzvT8wp9+I
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

NSIS:Downloader-AAT [PUP] also known as:

K7AntiVirusTrojan-Downloader ( 0055e3ed1 )
Elasticmalicious (high confidence)
DrWebAdware.IBryte.37
CynetMalicious (score: 99)
CAT-QuickHealPUA.NSIS.Adload.A
ALYacGeneric.Application.Adload.92BBD409
CylanceUnsafe
K7GWTrojan-Downloader ( 0055e3ed1 )
Cybereasonmalicious.783a86
SymantecTrojan.Gen.MBT
ESET-NOD32NSIS/TrojanDownloader.Adload.I
APEXMalicious
AvastNSIS:Downloader-AAT [PUP]
ClamAVWin.Dropper.Formbook-9783426-0
KasperskyUDS:Trojan-Downloader.NSIS.Agent.gen
BitDefenderGen:Application.Downloader.InstallMonster.2.084cuY@bWHdwTki
NANO-AntivirusRiskware.Nsis.Adw.cvvuyg
MicroWorld-eScanGen:Application.Downloader.InstallMonster.2.084cuY@bWHdwTki
Ad-AwareGen:Application.Downloader.InstallMonster.2.084!vZ@bWHdwTki
SophosMal/Generic-S
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_SPNR.15I014
McAfee-GW-EditionBehavesLike.Win32.AdwareAdload.vc
FireEyeGeneric.mg.da13113783a8674c
EmsisoftGeneric.Application.Adload.92BBD409 (B)
SentinelOneStatic AI – Malicious SFX
AviraTR/Dldr.Adload.uzzze
Antiy-AVLTrojan/Generic.ASMalwNS.9A7
MicrosoftSoftwareBundler:Win32/Penzievs
GDataNSIS.Trojan-Downloader.Adload.K
McAfeeArtemis!DA13113783A8
MAXmalware (ai score=82)
VBA32AdWare.AdLoad
TrendMicro-HouseCallTROJ_SPNR.15I014
FortinetRiskware/Adload
AVGNSIS:Downloader-AAT [PUP]

How to remove NSIS:Downloader-AAT [PUP]?

NSIS:Downloader-AAT [PUP] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment