Trojan:Win32/Ekstak.GAF!MTB removal

The Trojan:Win32/Ekstak.GAF!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Ekstak.GAF!MTB virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Ekstak.GAF!MTB?


File Info:
name: 21EC83F498A9D39FD370.mlw
path: /opt/CAPEv2/storage/binaries/9c92893fbe31d5e24fbe100202965e42dc23f6dff9722def66d661c1ef2c2359
crc32: D9018F75
md5: 21ec83f498a9d39fd370d08eb233a84e
sha1: ef944853f3f566f2295e020594945c6be5dae32f
sha256: 9c92893fbe31d5e24fbe100202965e42dc23f6dff9722def66d661c1ef2c2359
sha512: 0c92bd2e3a334d5b45c472343899df2ffe1794e60e61dff305f63de317b206cb3912356210d232c953dfe744b9992f695aa7ae8bea7bb48c8d6b6c37f9a5f36a
ssdeep: 98304:h17TFDX7jJwaFzKeLM/bMWtRnvtFNCQ18mTdA9cCnuXcQn/l0n8L:N5bzKzbMeRnvtFpZTdA9cRnX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18A3633B382E34874E0126DF16CA243172DB96E669273CA75F36D58DE6B43CB281197C3
sha3_384: 870795f4bbc1e1cec2c08c77e34e83b53b2e17ddb377683fe4b3dc02f2259c678f0f995481d99816365f73eeed8d6330
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 2023-12-18 21:49:55

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: PRingTone Setup                                             
FileVersion:                     
LegalCopyright:                                                                                                     
ProductName: PRingTone                                                   
ProductVersion: 1.2.1.8             
Translation: 0x0000 0x04b0

Trojan:Win32/Ekstak.GAF!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Ekstak.4!c
MicroWorld-eScan	Trojan.Generic.34690554
FireEye	Trojan.Generic.34690554
Skyhigh	BehavesLike.Win32.BadFile.rc
ALYac	Trojan.Generic.34690554
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Vot6
Arcabit	Trojan.Generic.D21155FA
APEX	Malicious
Cynet	Malicious (score: 100)
BitDefender	Trojan.Generic.34690554
Avast	Win32:Malware-gen
Sophos	Mal/Generic-S
Zillya	Trojan.Ekstak.Win32.75742
Emsisoft	Trojan.Generic.34690554 (B)
Ikarus	Trojan.Win32.Ekstak
Google	Detected
Microsoft	Trojan:Win32/Ekstak.GAF!MTB
GData	Trojan.Generic.34690554
Varist	W32/Agent.YLUO-6236
McAfee	Artemis!21EC83F498A9
MAX	malware (ai score=84)
Malwarebytes	Malware.AI.4010000700
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R002H01LO23
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Ekstak.GAF!MTB?

Trojan:Win32/Ekstak.GAF!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X