Trojan:Win32/Ekstak.ASES!MTB removal instruction

The Trojan:Win32/Ekstak.ASES!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ekstak.ASES!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Behavioural detection: Transacted Hollowing
• Uses suspicious command line tools or Windows utilities
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Ekstak.ASES!MTB?

File Info:
name: 1A8FC6C984B0F5251BC2.mlw
path: /opt/CAPEv2/storage/binaries/1ace25e5a499e81ed8efb7191b054cb2878138120b76acbb3a37ad0eff464097
crc32: E893421B
md5: 1a8fc6c984b0f5251bc220f8ae7cfad0
sha1: 4fd1cc534178f8a9fc082ce685fdac251ce72ca8
sha256: 1ace25e5a499e81ed8efb7191b054cb2878138120b76acbb3a37ad0eff464097
sha512: 9c3f040f7e53525063bb63f8656bd62004fba7eabee46af8727b8595dd88ec7bdf94b8f0f3dd47b3b8380ad022f19739f55fa5acf6c4031d03e53efec3922930
ssdeep: 196608:yCy7RfIviBIWwzEva/pN4xaRFozAP/UnISUvU4dsZFg:FyVftBlaxNvRFw6Uasg
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11F763358D172847CDDF8C93498B16C1729F67EB6018046D23EE42F2CAF07A71F9A6768
sha3_384: dfd42a9ea1564157236b9738e67be6026bbe6dc4842b160f7a2cbbf2fb2e6939a9422e451d1a36f18d72f5163376168f
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 2024-01-24 07:56:10

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: ODBC Standard Extension 0.1.2.4 Setup                       
FileVersion:                     
LegalCopyright:                                                                                                     
ProductName: ODBC Standard Extension 0.1.2.4                             
ProductVersion: 0.1.2.4             
Translation: 0x0000 0x04b0

Trojan:Win32/Ekstak.ASES!MTB also known as:

How to remove Trojan:Win32/Ekstak.ASES!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.