Trojan.Win32.Ekstak.almxn information

The Trojan.Win32.Ekstak.almxn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Ekstak.almxn virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Likely virus infection of existing system binary

How to determine Trojan.Win32.Ekstak.almxn?

File Info:
name: A1D8308B34288FAEA97D.mlw
path: /opt/CAPEv2/storage/binaries/9d2381aebd463cb256112882915db3438b755caa6328d17aec30f0e77375c884
crc32: 4DF1E264
md5: a1d8308b34288faea97d2ebe88dec314
sha1: 2aab8b2391069622dbc985514ab01cc6b19e971a
sha256: 9d2381aebd463cb256112882915db3438b755caa6328d17aec30f0e77375c884
sha512: 8ddc4e9b7f451154c774e36eee1693e7d5148afd790369661db97e883f657c67381d68408f5c6a06c3d87df3cef6bfce765017c056a3795c489b15bc727fb155
ssdeep: 196608:EbWCy1B3Chkj44oWWHT5V0AhJkivJsj4W1fyYD:k2j44BWHT5V3xmjNjD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17586236BAF4082DED05A8C75EB2544F41DF2B337252550DC0BB9ABBA0D342E0CB675E6
sha3_384: ecd7a50dbb054204fe20dd9d9f62154e5a99c311d7bd83c645a2a690c30f9bdc593fb786250c2b20bf8173cb7b8dd3ba
ep_bytes: 558bec83c4cc53565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: Recover Keys                                                
FileDescription: Recover Keys Setup                                          
FileVersion:                     
LegalCopyright:                                                                                                     
Translation: 0x0409 0x04e4

Trojan.Win32.Ekstak.almxn also known as:

How to remove Trojan.Win32.Ekstak.almxn?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.