What is “Trojan:Win32/Ekstak.ES!MTB”?

The Trojan:Win32/Ekstak.ES!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Ekstak.ES!MTB virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Ekstak.ES!MTB?


File Info:
name: 4705F7A80230BF69496C.mlw
path: /opt/CAPEv2/storage/binaries/8c3e657350efaf1294b22045215658f3ea0ec42fac8228f62105d5a26d84c461
crc32: 8751AD65
md5: 4705f7a80230bf69496cc6c4d4ae00b5
sha1: 4ecfae844b7cfb6f84bb1692b639cc153a8851b5
sha256: 8c3e657350efaf1294b22045215658f3ea0ec42fac8228f62105d5a26d84c461
sha512: e4fdd03624b3f6097ce775a42a59ad586f81db7f4d76d7df46d088099ba2666c2ba27cf45cf89cff17a5f04f009a331b4ee6de9a16bc48f86b6570520b024136
ssdeep: 98304:NtTok1HTszEqRgFUDz5/9BSHnzYa/8Ac5ZdEd6HxSRypeJj6fjA9/:bK1RLDFlBmnkzVbRkZ6fI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1563633405B14F0B2FBA5C13ACDD69AAC4C3FF88A4BA9245DB0684FDF493E524BC4535A
sha3_384: 0a7f197fae2e750c681a333011c95e86f9003b9a41407a3c07991c357edb6efb716052ebebbc7efa2ef0838fb30e8d10
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 2023-12-22 07:24:26

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: FlatControlSTD Setup                                        
FileVersion:                     
LegalCopyright:                                                                                                     
ProductName: FlatControlSTD                                              
ProductVersion: 1.2.2.2             
Translation: 0x0000 0x04b0

Trojan:Win32/Ekstak.ES!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Ekstak.4!c
MicroWorld-eScan	Trojan.Generic.34642557
FireEye	Trojan.Generic.34642557
Skyhigh	BehavesLike.Win32.ObfuscatedPoly.rc
ALYac	Trojan.Generic.34642557
Malwarebytes	Trojan.Dropper
Zillya	Trojan.Ekstak.Win32.76344
Sangfor	Trojan.Win32.Agent.V6u5
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
Arcabit	Trojan.Generic.D2109A7D
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
BitDefender	Trojan.Generic.34642557
Avast	Win32:Malware-gen
Emsisoft	Trojan.Generic.34642557 (B)
VIPRE	Trojan.Generic.34642557
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Ekstak
Varist	W32/Agent.BIZR-5116
Microsoft	Trojan:Win32/Ekstak.ES!MTB
GData	Trojan.Generic.34642557
Google	Detected
AhnLab-V3	Trojan/Win.Malware-gen.R629139
McAfee	Artemis!4705F7A80230
MAX	malware (ai score=80)
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R002H01LS23
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen

How to remove Trojan:Win32/Ekstak.ES!MTB?

Trojan:Win32/Ekstak.ES!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X