Trojan

Trojan.Win32.Ekstak.alvoo (file analysis)

Malware Removal

The Trojan.Win32.Ekstak.alvoo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Win32.Ekstak.alvoo virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Behavioural detection: Transacted Hollowing
  • Likely virus infection of existing system binary

How to determine Trojan.Win32.Ekstak.alvoo?


File Info:

name: 81B675D40521FD1D2D5A.mlw
path: /opt/CAPEv2/storage/binaries/8af61ea3184f69994d74bbfe4b08587309fa1d91344ecb109818df5c2811e23b
crc32: C27B42B9
md5: 81b675d40521fd1d2d5a4b70bab2a719
sha1: 307007d9b2edfa0e8385de35987ba11064e31d21
sha256: 8af61ea3184f69994d74bbfe4b08587309fa1d91344ecb109818df5c2811e23b
sha512: ded77be628ff7c9c71eb36cdd7e5e41dcba49316fcdac3c37c980f3ddce908329aaef3713cce24db383fbbaebcbe02362ff00fe5b8305efb8080e481a325b010
ssdeep: 196608:1HzrZ3zWCqIvERO+lP8IFJGVC7ODK5n6cP3jqgl3W8ADJRXWAV:pz1jMOtE5FJGVCKeRr7qglmrF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15C76336445C061BDE4D7F5B6AC60A1227D30BC0B2C27048BF9D97EB73E1A501BC7A99B
sha3_384: 08ce58fc52cce64e38ccf83790ddc8477b9705069e6199ee622dbaac9e500a03d5f71e6eb1031db8f1880db7b1019e86
ep_bytes: 558bec83c4cc53565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:

Comments: This installation was built with Inno Setup.
CompanyName: LLC "SysDev Laboratories"
FileDescription: Raise Data Recovery for Ext2/3/4 Setup
FileVersion:
LegalCopyright:
Translation: 0x0409 0x04e4

Trojan.Win32.Ekstak.alvoo also known as:

MicroWorld-eScanTrojan.GenericKD.50163650
FireEyeTrojan.GenericKD.50163650
ALYacTrojan.GenericKD.50163650
MalwarebytesAdware.DownloadAssistant
K7AntiVirusTrojan ( 005722fe1 )
K7GWTrojan ( 005722fe1 )
SymantecTrojan.Gen.2
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/TrojanDropper.Agent.SLC
TrendMicro-HouseCallTROJ_GEN.R002H0DCU22
Paloaltogeneric.ml
KasperskyTrojan.Win32.Ekstak.alvoo
BitDefenderTrojan.GenericKD.50163650
AvastWin32:Adware-gen [Adw]
TencentWin32.Trojan-dropper.Agent.Eadi
Ad-AwareTrojan.GenericKD.50163650
EmsisoftTrojan.GenericKD.50163650 (B)
McAfee-GW-EditionBehavesLike.Win32.AdwareFileTour.vc
SophosMal/Generic-S
GDataWin32.Backdoor.Bodelph.LD0BII
JiangminTrojan.Ekstak.bvud
MAXmalware (ai score=85)
ArcabitTrojan.Generic.D2FD6FC2
MicrosoftTrojan:Win32/Wacatac.B!ml
AhnLab-V3Adware/Win.Adware-gen.R481330
McAfeeArtemis!81B675D40521
CylanceUnsafe
IkarusTrojan-Dropper.Win32.Agent
AVGWin32:Adware-gen [Adw]
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Trojan.Win32.Ekstak.alvoo?

Trojan.Win32.Ekstak.alvoo removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment