About “Trojan.Win32.DiskWriter.hax” infection

The Trojan.Win32.DiskWriter.hax is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Win32.DiskWriter.hax virus can do?

Authenticode signature is invalid
Likely installs a bootkit via raw harddisk modifications
Attempted to write directly to a physical drive

How to determine Trojan.Win32.DiskWriter.hax?


File Info:
name: 18ED337904F1BF16A224.mlw
path: /opt/CAPEv2/storage/binaries/ca3f805e6f159c6d974302abb4b8fbbdc942e3bc4c19e4f18f4c6558dd2bb457
crc32: FF0DB475
md5: 18ed337904f1bf16a2249955d5697c89
sha1: f459094ff858bfccae4ca81396f3337355bf5414
sha256: ca3f805e6f159c6d974302abb4b8fbbdc942e3bc4c19e4f18f4c6558dd2bb457
sha512: 7c2fd068ba813d787854962309a55ee25fc15b5f5cebd10cdb9801b36c63ff0fc0ab89d1731f82d061c54b1f70910241dd3a72556fb7289409265a7cb0e05590
ssdeep: 48:q1MOPnjZgE4IVN7kXQyU29TjLvR2zCBLUR9pu7wtFeG1uHpi45RuqSA:0PFOAyU29zvR2WR69g+eRDxX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T126B1E7438D14C537D4B34232409B89389ABBCA6A43EA429F3BB6D3201FF2227DA19143
sha3_384: 7fef009a0e1223125503efd0c5c735b3e34458195c11cf0f5158d2ec8d2ef18ebaa4b3ef8f8b170c9c65ebf731d618e1
ep_bytes: e8cb020000e86002000033c0c3909090
timestamp: 2021-11-10 21:30:25

Version Info:
0: [No Data]

Trojan.Win32.DiskWriter.hax also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.DiskWriter.4!c
Cynet	Malicious (score: 100)
FireEye	Trojan.GenericKD.38097258
McAfee	Artemis!18ED337904F1
Alibaba	Trojan:Win32/DiskWriter.d2e30c65
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	Trojan.Win32.DiskWriter.hax
BitDefender	Trojan.GenericKD.38097258
MicroWorld-eScan	Trojan.GenericKD.38097258
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.38097258
Emsisoft	Trojan.GenericKD.38097258 (B)
McAfee-GW-Edition	BehavesLike.Win32.BadFile.zt
Sophos	Mal/Generic-R
GData	Trojan.GenericKD.38097258
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ALYac	Trojan.GenericKD.38097258
MAX	malware (ai score=88)
VBA32	BScope.Trojan.DiskWriter
Malwarebytes	Trojan.KillMBR
TrendMicro-HouseCall	TROJ_GEN.R002H0CKO21
Rising	Trojan.Generic@ML.89 (RDMK:qb/ldqkm5kE7qQaZC5JLDg)
SentinelOne	Static AI – Suspicious PE
AVG	Win32:Malware-gen
Cybereason	malicious.ff858b
Panda	Trj/GdSda.A

How to remove Trojan.Win32.DiskWriter.hax?

Trojan.Win32.DiskWriter.hax removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X