Trojan.Win32.Ekstak.ajyza (file analysis)

The Trojan.Win32.Ekstak.ajyza is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Ekstak.ajyza virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid

How to determine Trojan.Win32.Ekstak.ajyza?

File Info:
name: 9363DE840E5C6EA6C22F.mlw
path: /opt/CAPEv2/storage/binaries/2d1481e5d8b073063f889bdf50a383343ed8fa9ea7cb1d8b8794d6e97deafe1f
crc32: FC16490D
md5: 9363de840e5c6ea6c22f006e0dd6704a
sha1: 2812145dd9a5d36cb66a59d7cb94d3378837d0cd
sha256: 2d1481e5d8b073063f889bdf50a383343ed8fa9ea7cb1d8b8794d6e97deafe1f
sha512: 3b4dc20711990afa2bb8d69c8410fc661988235bdad734d22667c7fe5bb3a3bb1211b0ec3b9f5188967d2f129fcad05ba15699a1406b9b5aa187a995fd81fbc6
ssdeep: 98304:PX4eDGUdqi3O9qCz5LGv6DwOa2s9kDJMONQyazx14:vrDGU8F9qCTSX9yeya0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15F261227B298A13EC4AA37364673A05058FBB66DF417BE1636F0C48CCF650C51E3AB65
sha3_384: 12ef0a75e2d1d06af27c29d2c44ff655926570ebcf4da169adefedd8083ad070e25b3f760d401218d1f0f7b948041b70
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2019-04-27 08:22:11

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: Ea Setup                                                    
FileVersion:                     
LegalCopyright:                                                                                                     
OriginalFileName:                                                   
ProductName: Ea                                                          
ProductVersion: 0.5.16.1                                          
Translation: 0x0000 0x04b0

Trojan.Win32.Ekstak.ajyza also known as:

How to remove Trojan.Win32.Ekstak.ajyza?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.