RiskWare.CobaltStrike malicious file

The RiskWare.CobaltStrike is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What RiskWare.CobaltStrike virus can do?

Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
A process created a hidden window
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Deletes its original binary from disk
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine RiskWare.CobaltStrike?


File Info:
crc32: 1B633135
md5: dfd28caea3eca382ae4eb5e3ccbc6b81
name: dx7splm.exe
sha1: 3f01ecd5ea7ad2908fc4d8bb4aef32e41e290c3e
sha256: 613e73d245187709e0344feca8161c380f13a6e215a1a4d07f44d2984f853d02
sha512: 1e249964f58e6e03144ef2d76af98497dbd4e19cc46c6f0a19123760f851705533c657501e53680691c9388b33b41279e6f6b271ec941479e5bc7fdef7d4a1a3
ssdeep: 12288:6KMdMF9OgueBjGe7XU3WvPgdBxJX2rPg:bF97Bi6XbmDXqP
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
Translation: 0x0804 0x04b0

RiskWare.CobaltStrike also known as:

Bkav	W32.AIDetectVM.malware
MicroWorld-eScan	Gen:Win32.ProcessHijack.Du0@a4BfLGjj
FireEye	Generic.mg.dfd28caea3eca382
McAfee	GenericRXHX-XG!DFD28CAEA3EC
Malwarebytes	RiskWare.CobaltStrike
AegisLab	Hacktool.Win32.Shellcode.3!c
Sangfor	Malware
K7AntiVirus	Trojan ( 002e2afe1 )
BitDefender	Gen:Win32.ProcessHijack.Du0@a4BfLGjj
K7GW	Trojan ( 002e2afe1 )
Cybereason	malicious.ea3eca
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:ExploitX-gen [Trj]
ClamAV	Win.Exploit.Ursu-6994588-0
GData	Gen:Win32.ProcessHijack.Du0@a4BfLGjj
Kaspersky	Exploit.Win32.Shellcode.gxp
Alibaba	Trojan:Win32/Invader.f8596955
NANO-Antivirus	Exploit.Win32.Shellcode.fvvcdt
Rising	Exploit.ShellCode!8.2A (CLOUD)
Ad-Aware	Gen:Win32.ProcessHijack.Du0@a4BfLGjj
Sophos	Harmony Loader (PUA)
Comodo	Malware@#ohtcb8v1xsl1
F-Secure	Trojan.TR/Agent.ugaaw
DrWeb	Trojan.Inject3.25460
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.BrowseFox.gh
Emsisoft	Gen:Win32.ProcessHijack.Du0@a4BfLGjj (B)
Cyren	W32/Trojan.ENWV-8842
Jiangmin	Trojan.Invader.cat
MaxSecure	Trojan.Malware.73683431.susgen
Avira	TR/Agent.ugaaw
Antiy-AVL	Trojan[Exploit]/Win32.Shellcode
Endgame	malicious (high confidence)
Arcabit	Gen:Win32.ProcessHijack.E9A103
ZoneAlarm	Exploit.Win32.Shellcode.gxp
Microsoft	Trojan:Win32/Occamy.C
AhnLab-V3	Malware/Win32.RL_Generic.R266754
BitDefenderTheta	AI:Packer.00517F4F1F
ALYac	Gen:Win32.ProcessHijack.Du0@a4BfLGjj
MAX	malware (ai score=81)
VBA32	BScope.Adware.Presenoker
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Agent.THV
Tencent	Malware.Win32.Gencirc.10b2df8d
Yandex	Exploit.Shellcode!Y7DmbZu37n8
SentinelOne	DFI – Malicious PE
eGambit	Trojan.Generic
Fortinet	W32/Agent.THV!tr
AVG	Win32:ExploitX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Trojan.Exploit.620

How to remove RiskWare.CobaltStrike?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

RiskWare.CobaltStrike malicious file