Trojan.Ekstak.S1847398 malicious file

The Trojan.Ekstak.S1847398 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Ekstak.S1847398 virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Queries information on disks, possibly for anti-virtualization
Detects the presence of Wine emulator via registry key

How to determine Trojan.Ekstak.S1847398?


File Info:
crc32: 2D7D10CA
md5: e9dc2d8a7dc324e7b9a5f94bb13f62c4
name: E9DC2D8A7DC324E7B9A5F94BB13F62C4.mlw
sha1: 91c9dfd9d5fd55b999fbbe7ad3312140fd6ebe1c
sha256: 1de2947235b658279f1202d1e7a57179cbfec2d4d6b38e74cbf0b7b0ac18c92f
sha512: 00e757d4464aff36eb4836e245735b84172a03db6cb80b897d3509fd21a28b3e765c599285efec3211adf2fc366a6d35b697971b89df15597fcb72b9eacaa053
ssdeep: 49152:4oqm9DRp/gSCdchPGct4yu1eVhGAB+lRh:469DRhgSuKPGct1Vofh
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2005-2017 iform-zero Ltd
InternalName: ccleaner
FileVersion: 5, 32, 00, 6129
CompanyName: iform-zero Ltd
Comments: CCleaner
ProductName: CCleaner
ProductVersion: 5, 32, 00, 6129
FileDescription: CCleaner
OriginalFilename: ccleaner.exe
Translation: 0x0409 0x04b0

Trojan.Ekstak.S1847398 also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.InstallCube.2684
ClamAV	Win.Packed.Icloader-6952325-0
CAT-QuickHeal	Trojan.Ekstak.S1847398
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.1347522
Sangfor	Trojan.Win32.Ekstak.a
CrowdStrike	win/malicious_confidence_70% (D)
K7GW	Trojan ( 00524ddf1 )
K7AntiVirus	Trojan ( 00524ddf1 )
Cyren	W32/S-9daa2097!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.GCFI
APEX	Malicious
Avast	Win32:DangerousSig [Trj]
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Win32.Ekstak.a
BitDefender	Gen:Variant.Symmi.83067
NANO-Antivirus	Trojan.Win32.InstallCube.exgqpf
MicroWorld-eScan	Gen:Variant.Symmi.83067
Ad-Aware	Gen:Variant.Symmi.83067
Comodo	Application.Win32.ICLoader.GEM@7kji8x
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	GenericRXDW-JA!E9DC2D8A7DC3
FireEye	Generic.mg.e9dc2d8a7dc324e7
Emsisoft	Application.AdLoad (A)
SentinelOne	Static AI – Malicious PE
Avira	TR/Crypt.XPACK.Gen
eGambit	Unsafe.AI_Score_100%
Antiy-AVL	Trojan/Generic.ASMalwS.24464D3
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	PUADlManager:Win32/InstallCube
Arcabit	Trojan.Symmi.D1447B
GData	Gen:Variant.Symmi.83067
AhnLab-V3	Trojan/Win32.Ekstak.R218561
Acronis	suspicious
McAfee	GenericRXDW-JA!E9DC2D8A7DC3
MAX	malware (ai score=81)
VBA32	BScope.Trojan.InstallCube
Malwarebytes	Adware.LoadMoney
Panda	Trj/Genetic.gen
Rising	Trojan.Kryptik!1.AFA6 (CLASSIC)
Yandex	Trojan.GenAsa!aqWRZoW1t+Q
Ikarus	PUA.FileTour
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CoinMiner.GYQC!tr
AVG	Win32:DangerousSig [Trj]
Paloalto	generic.ml

How to remove Trojan.Ekstak.S1847398?

Trojan.Ekstak.S1847398 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X