About “Trojan.Win32.Ekstak.almso” infection

The Trojan.Win32.Ekstak.almso is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Ekstak.almso virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Likely virus infection of existing system binary

How to determine Trojan.Win32.Ekstak.almso?

File Info:
name: 61A5B24FFEF3EB91B601.mlw
path: /opt/CAPEv2/storage/binaries/5eda61f548cd82003ea251967bbfbfcc99345f8845a3b6622b2008835e08062b
crc32: 6DCBF1E4
md5: 61a5b24ffef3eb91b6010171fa284769
sha1: 2708150d20abbf5b4c34052bf9d46917b9ce8886
sha256: 5eda61f548cd82003ea251967bbfbfcc99345f8845a3b6622b2008835e08062b
sha512: 82de2ce975390d5e323fb2ceba7b566a5cf4c3c7ab478a8c71cdd05297875cf55d0331e6b5fd76eb851bdcfc28fb6fa69cf5c83fad50c408b0c93693090db504
ssdeep: 98304:fEKchrrXwiJ4kKZkCEb58km6hRVVYQ6X2yJ6L/f/Y686X0ugy:mNXww49ZkCch1YdH8Lw6Bz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18F36123FB228653ED4AE4B3246B39350997BBA62781B8C1E47F0490DCF664702E3F655
sha3_384: 746325b7c420d7992cf9d56b7f79151de2a86e22d1b8a46d81c103d00d756d6ae65b4be59a30cf58bccff06ee81b9487
ep_bytes: 558bec83c4a453565733c08945c08945
timestamp: 2020-03-14 17:59:41

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: ite2unblock.com                                             
FileDescription: File Folder Shredder Setup                                  
FileVersion:                     
LegalCopyright:                                                                                                     
OriginalFileName:                                                   
ProductName: File Folder Shredder                                        
ProductVersion: 1.1.0.1                                           
Translation: 0x0000 0x04b0

Trojan.Win32.Ekstak.almso also known as:

How to remove Trojan.Win32.Ekstak.almso?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.