Categories: Trojan

About “Trojan.Win32.Ekstak.nvxw” infection

The Trojan.Win32.Ekstak.nvxw is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Ekstak.nvxw virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Enumerates running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial language used in binary resources: Korean
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Executable file is packed/obfuscated with MPRESS
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan.Win32.Ekstak.nvxw?


File Info:
name: AC5C0840CE4197AB8708.mlwpath: /opt/CAPEv2/storage/binaries/18658f0601ce8af20a24141b3c1499aae184416ddbe834e4bb2f83ea55e6675ccrc32: 05F25F5Emd5: ac5c0840ce4197ab87086c4c0a6ee810sha1: 4c30b018bb774b455ef6392af2146884f0f48a85sha256: 18658f0601ce8af20a24141b3c1499aae184416ddbe834e4bb2f83ea55e6675csha512: a2c63aedee6d034da25f21b862b085f3d36a78b0e9544f1dd23038de260a30232ab3ee79cf8b57eeac2fe414157027dcbdbc687924437df47b3f1c7cce515808ssdeep: 3072:QKSAEbalxNW1oaaCUK7pBghMjDDDDQpGMUnVI1kOWXZVyTarERccD7Y:QpNeloJVRD/cAMUVSkOMV8Gu7Ytype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E524DF029A018928F71D0F311956F9E488A59D3C28E0F68FF67CBD3A78B21875A7714Fsha3_384: e081610a48fcc87d1c76b2c0f6acf2df00c21ba881487672749d5e658bff811412e4568c6af7a358778e5a89d149a77cep_bytes: 60e80000000058055a0b00008b3003f0timestamp: 2013-10-15 11:01:41
Version Info:
0: [No Data]

Trojan.Win32.Ekstak.nvxw also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Ekstak.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen5.60190
MicroWorld-eScan	Gen:Heur.Mint.SP.Urelas.1
FireEye	Generic.mg.ac5c0840ce4197ab
CAT-QuickHeal	Trojan.Urelas.C.mue
McAfee	Obfuscated-FAHQ!hb
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Spyware ( 0048c72d1 )
Alibaba	TrojanSpy:Win32/Ekstak.64b455f3
K7GW	Spyware ( 0048c72d1 )
Cybereason	malicious.0ce419
BitDefenderTheta	Gen:NN.ZexaF.34294.nmraaigqdjai
Cyren	W32/A-351ea3cc!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.CardSpy.NAF
TrendMicro-HouseCall	TROJ_URELAS_GI080278.UVPM
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Ekstak.nvxw
BitDefender	Gen:Heur.Mint.SP.Urelas.1
NANO-Antivirus	Trojan.Win32.CardSpy.dkjoul
SUPERAntiSpyware	Trojan.Agent/Gen-CardSpy
Avast	Win32:Crypt-QBK [Trj]
Tencent	Malware.Win32.Gencirc.11d59aa5
Ad-Aware	Gen:Heur.Mint.SP.Urelas.1
Emsisoft	Gen:Heur.Mint.SP.Urelas.1 (B)
Comodo	TrojWare.Win32.Wecod.AF@55img7
Baidu	Win32.Trojan.Urelas.d
Zillya	Trojan.Cardspy.Win32.74
TrendMicro	TROJ_URELAS_GI080278.UVPM
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.dc
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Beaugrit
GData	Win32.Trojan.PSE.1CJPTFZ
Jiangmin	Trojan.Ekstak.budc
eGambit	Unsafe.AI_Score_99%
Avira	TR/Crypt.XPACK.Gen3
Antiy-AVL	Trojan/Generic.ASMalwS.CFD10F
Gridinsoft	Ransom.Win32.Zbot.sa
Arcabit	Trojan.Mint.SP.Urelas.1
ViRobot	Trojan.Win32.Z.Wecod.228484.A
Microsoft	Trojan:Win32/Urelas.AA
SentinelOne	Static AI – Malicious PE
AhnLab-V3	Backdoor/Win32.Plite.R84435
Acronis	suspicious
VBA32	Trojan.Wecod
Malwarebytes	Malware.AI.768115141
APEX	Malicious
Yandex	TrojanSpy.CardSpy!53DhpyjygcU
MAX	malware (ai score=85)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Wecod.ALL!tr
Webroot	W32.Trojan.Gen
AVG	Win32:Crypt-QBK [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)