Trojan-Downloader.Win32.Stralo.fl (file analysis)

Malware Removal

The Trojan-Downloader.Win32.Stralo.fl is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Review

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan-Downloader.Win32.Stralo.fl virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Expresses interest in specific running processes
  • The binary likely contains encrypted or compressed data.
  • Checks for the presence of known windows from debuggers and forensic tools
  • The following process appear to have been packed with Themida: intervpnpub2.exe
  • Checks for the presence of known devices from debuggers and forensic tools
  • Detects the presence of Wine emulator via registry key
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
iplogger.org
lqo02.pro
a.tomx.xyz

How to determine Trojan-Downloader.Win32.Stralo.fl?


File Info:

crc32: B65856CD
md5: 511c980c15d5d7aab290406f19582490
name: intervpnpub2.exe
sha1: 87ef89513312a5c73b2525df4829af4ea5126cde
sha256: 2d517c69a96bb687b3688225eeaa7be8cbd9391a22b51db1cf66d8816c000d21
sha512: bc070bcbde4d91747481c50248b484be7236668a0180ad332cfa8c4e83e97d13f48ecd9231f250a8fb4d20f9758baaf4df6a687a4a651bb0a101005671fce5b7
ssdeep: 49152:VP5CphY645job3frbgxxKfiIwvyskcdjYWj29dkie:15C86jLfru5jyskcdjYtUi
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright:
InternalName:
FileVersion: 1.1.30.00
ProductName:
ProductVersion: 1.1.30.00
FileDescription:
OriginalFilename:
Translation: 0x0409 0x04b0

Trojan-Downloader.Win32.Stralo.fl also known as:

BkavW32.HfsAutoB.
MicroWorld-eScanTrojan.GenericKD.33255192
FireEyeGeneric.mg.511c980c15d5d7aa
Qihoo-360Win32/Trojan.Downloader.3a6
McAfeeArtemis!511C980C15D5
CylanceUnsafe
SangforMalware
K7AntiVirusTrojan ( 00559ab31 )
BitDefenderTrojan.GenericKD.33255192
K7GWTrojan ( 00559ab31 )
Cybereasonmalicious.13312a
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Trojan-gen
GDataWin32.Trojan.Ilgergop.BZP0JI
KasperskyTrojan-Downloader.Win32.Stralo.fl
AlibabaPacked:Win32/Themida.4ee70ec2
AegisLabTrojan.Win32.Generic.4!c
RisingTrojan.Generic!8.C3 (CLOUD)
Endgamemalicious (high confidence)
EmsisoftTrojan.GenericKD.33255192 (B)
F-SecureHeuristic.HEUR/AGEN.1038489
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Trojan.vc
SophosMal/Generic-S
IkarusTrojan-Downloader.Win32.Autohk
WebrootW32.Malware.Gen
AviraHEUR/AGEN.1038489
MAXmalware (ai score=85)
ArcabitTrojan.Generic.D1FB6F18
ZoneAlarmTrojan-Downloader.Win32.Stralo.fl
MicrosoftTrojan:Win32/Wacatac.D!ml
Acronissuspicious
ALYacTrojan.GenericKD.33260400
Ad-AwareTrojan.GenericKD.33255192
PandaTrj/CI.A
ESET-NOD32a variant of Win32/Packed.Themida.GZV
TencentWin32.Trojan-downloader.Stralo.Srng
SentinelOneDFI – Suspicious PE
eGambitUnsafe.AI_Score_99%
FortinetW32/Generic!tr
AVGWin32:Trojan-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Trojan-Downloader.Win32.Stralo.fl?

Trojan-Downloader.Win32.Stralo.fl removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment