What is “Trojan.Win32.Ekstak.anxli”?

The Trojan.Win32.Ekstak.anxli is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Ekstak.anxli virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Deletes executed files from disk
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.Win32.Ekstak.anxli?

File Info:
name: BCDD7D2777ECD81B10A7.mlw
path: /opt/CAPEv2/storage/binaries/3d5d81e46411a70d531e4012287873c46be3acfa071f781521e78f36fcad104b
crc32: 2D700EAD
md5: bcdd7d2777ecd81b10a79dd11a1ac564
sha1: 65e3c41748ae51a587e9d7daedc2c9d6bc7e8701
sha256: 3d5d81e46411a70d531e4012287873c46be3acfa071f781521e78f36fcad104b
sha512: e20529185fd8e7d7f981aeb195484b4343127eb130e7def0534cdc0f95e28c41dbfbc2fc1f92430d734dc2183cb1c6be6c867da0775baedf174550a11bdaefd1
ssdeep: 98304:ec2JyhsmA9jBK/Y6GSzi5KDlQSaGWqSrOuGD0a6cC6:t+ljE2WUGWqZeY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AC26330297E28E74F87581305B1EE6384A367C33162C131A7BAE4FDEED48AD16D5E760
sha3_384: 2f089d4191f042c46c7c6018baca553fd8f49ca53a5bb951ba8787b9cacfac9d2982d2ecf1a0f76355b6de4f49af734b
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 1992-06-19 22:22:17

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: SH-Explorer Setup                                           
FileVersion:                     
LegalCopyright:                                                                                                     
Translation: 0x0409 0x04e4

Trojan.Win32.Ekstak.anxli also known as:

How to remove Trojan.Win32.Ekstak.anxli?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.