Trojan

Trojan.Win32.Llac.dext malicious file

Malware Removal

The Trojan.Win32.Llac.dext is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Win32.Llac.dext virus can do?

  • Injection (inter-process)
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • A process created a hidden window
  • Uses Windows utilities for basic functionality
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Creates a copy of itself
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
1921681131.ddns.net

How to determine Trojan.Win32.Llac.dext?


File Info:

crc32: 40580124
md5: e09d9774a5a313d21f0e1412108e05bf
name: E09D9774A5A313D21F0E1412108E05BF.mlw
sha1: 825d4caa2081f29bf8f23d58ce0ef485351e728c
sha256: 10ddf5e288050c2f28cac5da60ebb4f0a679c26b58a1efe5895efe9e55bb659a
sha512: 1774a29378e5e15123bb004f31be4d41a886d9ed8a697a22a2cba7d5ac52634235d8b7ac1a389c8ee4a2324e268dc9c8bd1e152d4daec65f8f46a190af5a8c5a
ssdeep: 24576:cRmJkcoQricOIQxiZY1iaEAHG1T9ZZBDk2waM6tzkFxYaTGtvFn/F9qi4:JJZoQrbTFZY1iaDHG1BfBNM6eFjKnG
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

CompiledScript: AutoIt v3 Script: 3, 3, 8, 1
FileVersion: 3, 3, 8, 1
FileDescription:
Translation: 0x0809 0x04b0

Trojan.Win32.Llac.dext also known as:

BkavW32.AIDetect.malware2
K7AntiVirusTrojan ( 0048b1441 )
LionicTrojan.Win32.Llac.4!c
Elasticmalicious (high confidence)
DrWebTrojan.Bankfraud.3628
CynetMalicious (score: 100)
ALYacGen:Variant.Ursu.519232
CylanceUnsafe
ZillyaTrojan.Llac.Win32.61725
CrowdStrikewin/malicious_confidence_100% (D)
AlibabaTrojanBanker:Win32/Lokmwiz.757e325a
K7GWTrojan ( 0048b1441 )
Cybereasonmalicious.4a5a31
CyrenW32/AutoIt.AQ2.gen!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32multiple detections
APEXMalicious
AvastScript:SNH-gen [Trj]
ClamAVWin.Malware.Autoit-6912463-0
KasperskyTrojan.Win32.Llac.dext
BitDefenderAIT:Trojan.Nymeria.4018
NANO-AntivirusTrojan.Win32.Bankfraud.efjtmx
MicroWorld-eScanAIT:Trojan.Nymeria.4018
TencentWin32.Trojan.Llac.Airt
Ad-AwareAIT:Trojan.Nymeria.4018
SophosMal/Generic-S
ComodoMalware@#17rmtw3vdtehj
BitDefenderThetaAI:Packer.0DA08E8C16
TrendMicroRansom_Lokmwiz.R002C0CFE21
McAfee-GW-EditionBehavesLike.Win32.Generic.tc
FireEyeGeneric.mg.e09d9774a5a313d2
EmsisoftAIT:Trojan.Nymeria.4018 (B)
JiangminTrojan.Llac.fli
AviraHEUR/AGEN.1110297
eGambitUnsafe.AI_Score_90%
Antiy-AVLTrojan/Generic.ASCommon.168
KingsoftWin32.Troj.Banker.(kcloud)
MicrosoftRansom:AutoIt/Lokmwiz.A
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataGen:Variant.Ursu.519232 (2x)
AhnLab-V3Trojan/Win32.Banki.R213572
McAfeeArtemis!E09D9774A5A3
MAXmalware (ai score=100)
VBA32Trojan.Autoit.F
MalwarebytesGeneric.Trojan.Malicious.DDS
PandaTrj/CI.A
TrendMicro-HouseCallRansom_Lokmwiz.R002C0CFE21
RisingTrojan.Obfus/Autoit!1.BEDE (CLASSIC)
YandexTrojan.GenAsa!IZxoZO1iAfE
IkarusTroajn-Ransom.Crypt888
MaxSecureTrojan.Autoit.AZA
FortinetAutoIt/Agent.BQ!tr
AVGScript:SNH-gen [Trj]
Paloaltogeneric.ml

How to remove Trojan.Win32.Llac.dext?

Trojan.Win32.Llac.dext removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment