Trojan.Win32.Ekstak.aomhs removal instruction

The Trojan.Win32.Ekstak.aomhs is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Ekstak.aomhs virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.Win32.Ekstak.aomhs?

File Info:
name: 4ACF510AA62DD3E50733.mlw
path: /opt/CAPEv2/storage/binaries/e0d93782fbb0f7e8eb3795f4cd7d4144b066bc8a14cbbea47a5d706752ad54d3
crc32: 49161AEE
md5: 4acf510aa62dd3e50733bcf477de9985
sha1: 6bb2968828f4a554f9f6540a95e96a695219cfdb
sha256: e0d93782fbb0f7e8eb3795f4cd7d4144b066bc8a14cbbea47a5d706752ad54d3
sha512: c3f0cd66dd186175a9466a0d71b9c7fe5f59e4251c28a527359edf07994c022812219ab1d45935365dfa62562e672748f450531f848b3f835c3479a30e35bc98
ssdeep: 196608:DSly/d71p18itTOwxu6dNsPjy4NjwcVORJQXflRJBHnlp:DKy/dXaitKMuw0OyjwcVEatRJhnlp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12B863312F75EA4BAE593BAB44F8F4A20D951ACF035B207817621346B7F3359FA61C318
sha3_384: 0f0bed0b9f8947719caf1f1261277b7f7d7b3911af87072f1089b0a8437c215c4ba6a7f3b75f7fc72434e7639443cce7
ep_bytes: 558bec83c4cc53565733c08945f08945
timestamp: 2023-09-03 17:06:16

Version Info:
Comments: This installation was built with Inno Setup: http://www.innosetup.com
CompanyName:                                                             
FileDescription: DVDStyler Setup                                             
FileVersion:                     
LegalCopyright:                                                                                                     
Translation: 0x0409 0x04e4

Trojan.Win32.Ekstak.aomhs also known as:

How to remove Trojan.Win32.Ekstak.aomhs?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.