Trojan

Trojan-Downloader.Win32.Adload.tlty removal tips

Malware Removal

The Trojan-Downloader.Win32.Adload.tlty is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan-Downloader.Win32.Adload.tlty virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • At least one process apparently crashed during execution
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Likely virus infection of existing system binary

Related domains:

wpad.local-net
olustgtapi.live

How to determine Trojan-Downloader.Win32.Adload.tlty?


File Info:

name: 52122A3A07FB657668F1.mlw
path: /opt/CAPEv2/storage/binaries/80d2c0e049779e4a3a5ab367b08b7d156b5191ad6190ce48f3d44cbddb4ce598
crc32: E060DE5E
md5: 52122a3a07fb657668f1ee527c9059e9
sha1: 1704562209b13703dc0bc8c7ff0cec3e664951ca
sha256: 80d2c0e049779e4a3a5ab367b08b7d156b5191ad6190ce48f3d44cbddb4ce598
sha512: 009fe23411e5523be235a34c16c489d713fd622edb7b85bdb2b13e49d245611d1c9fa4f1ee57873b89f4940aa9059b49a5ad048c0e6d6093adf0c0c243325c35
ssdeep: 98304:R1QTn6kSuBtNolknwN+qB44bU7oX+uA0VJXa5jx3m8ChsJYq:XIFSAtNCknwFvEDuA0V3fq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15D36F1667B19D425C19AE370A6227240A4F7BE68F593DD2DF1F4F44CC73AAC02D2E216
sha3_384: 1014f9006a065fa2edde347ce89bd12ff09504643a30b5d87193658830611006392b313fde2da8d417d9b301d4fb9bf0
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2021-07-22 05:43:38

Version Info:

Comments: This installation was built with Inno Setup.
CompanyName: Itplicity, Inc.
FileDescription: IIViewer Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: IIViewer
ProductVersion:
Translation: 0x0000 0x04b0

Trojan-Downloader.Win32.Adload.tlty also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
K7AntiVirusTrojan ( 005722f11 )
AlibabaAdWare:Win32/AdLoad.3a3e0b21
K7GWTrojan ( 005722f11 )
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win32/TrojanDropper.Agent.SLC
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan-Downloader.Win32.Adload.tlty
AvastWin32:Trojan-gen
SophosMal/Generic-S
McAfee-GW-EditionBehavesLike.Win32.Dropper.rc
GDataWin32.Backdoor.Bodelph.E2QH2Z
AviraHEUR/AGEN.1144245
GridinsoftRansom.Win32.Sabsik.sa
MicrosoftTrojan:Script/Phonzy.C!ml
CynetMalicious (score: 100)
McAfeeArtemis!52122A3A07FB
VBA32TrojanDownloader.Adload
MalwarebytesAdware.DownloadAssistant
TrendMicro-HouseCallTROJ_GEN.R002H0CKN21
IkarusTrojan-Dropper.Win32.Agent
FortinetW32/Agent.SLC!tr
AVGWin32:Trojan-gen

How to remove Trojan-Downloader.Win32.Adload.tlty?

Trojan-Downloader.Win32.Adload.tlty removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment