What is “Trojan:Win32/Ekstak.KAA!MTB”?

The Trojan:Win32/Ekstak.KAA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ekstak.KAA!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• CAPE detected the embedded win api malware family
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Ekstak.KAA!MTB?

File Info:
name: 6D177E08758449E5D178.mlw
path: /opt/CAPEv2/storage/binaries/5a58acc12088b2dd9a4325ca7b8a1fe77d8d854c03fb21985e746979b72aec84
crc32: 6C299394
md5: 6d177e08758449e5d1786cc8b1258fe6
sha1: ada20f0dc3c336fb912178c5350816e91c9bb5fe
sha256: 5a58acc12088b2dd9a4325ca7b8a1fe77d8d854c03fb21985e746979b72aec84
sha512: 853d0f098de9d413dea4ff2759264f69f2fdc6874f3499754cc966e8a38cf524875d2106352a3ddb9e439bb667471d31bec22596164192d63287d7782b1d9fef
ssdeep: 98304:5+3EMPDnWIt0+ySGMxwRR4GG5LPrnarFLMlFmL4lG0U/5FsOT5yc1t3:A3E8DWItzdgReerFLcFmLPH5Fn5R
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F3263397F6018479D8628CBE0E449308A8BAF8291A76F548537DBE2CDC774C983D6773
sha3_384: 8b9997b1cad1563566de444be4af14d8218a68a8943c0f54f29cb5a10140e940cd30a8b9086b9cc92634ad7a40d8a854
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 2024-01-31 20:10:51

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: VB DateTime Library Setup                                   
FileVersion:                     
LegalCopyright:                                                                                                     
ProductName: VB DateTime Library                                         
ProductVersion:                     
Translation: 0x0000 0x04b0

Trojan:Win32/Ekstak.KAA!MTB also known as:

How to remove Trojan:Win32/Ekstak.KAA!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.