What is “Trojan-Downloader.Win32.Cobalt.azv”?

The Trojan-Downloader.Win32.Cobalt.azv is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Downloader.Win32.Cobalt.azv virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Uses Windows utilities for basic functionality
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• The executable used a known stolen/malicious Authenticode signature
• Attempts to modify proxy settings
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan-Downloader.Win32.Cobalt.azv?

File Info:
name: DFAA38D5CFB11970D284.mlw
path: /opt/CAPEv2/storage/binaries/6833d3e13c7996dcfc0301bb9b35b60c953c3338a8d5a8b7e5b9d999605fd61e
crc32: 1709D1A4
md5: dfaa38d5cfb11970d284b19ea1bfccaa
sha1: 787ae2bd663233cf8437b1d00ebaa7cea32d9f0e
sha256: 6833d3e13c7996dcfc0301bb9b35b60c953c3338a8d5a8b7e5b9d999605fd61e
sha512: 150a711414fe5d276e4b3b23b6f5a205ef7799f118be5d8b63a0cfa5c0bc487a93f6e73aba59a1fc003d496a5c10f6627e8a51fd82b8e0f4fcf96dc9a30ce111
ssdeep: 49152:TklQVuDHkbRK3rCKhBN4j3fApwJ7h0kk6p1Z6g:Tkl5Ebx6g
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CF06BF61F99794F2EA02053004ABA3AF2330BA069B35CAC7D6447F6BEC775E10D37956
sha3_384: ca6f8b5f87e63f46e30298ff63c107924cafc4ece1467e22c7f59af786d524780f0b8d247b30c2f6780db73bd0dcc52e
ep_bytes: e91bddffffcccccccccccccccccccccc
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan-Downloader.Win32.Cobalt.azv also known as:

How to remove Trojan-Downloader.Win32.Cobalt.azv?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.