Should I remove “Trojan:Win32/Ekstak!pz”?

The Trojan:Win32/Ekstak!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Ekstak!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Behavioural detection: Transacted Hollowing
• Created a service that was not started
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Ekstak!pz?

File Info:
name: 0175E23C1B04EDECB6DF.mlw
path: /opt/CAPEv2/storage/binaries/f78392a1e52f46a9b283bb70f76984851831af375465ecc9ae77c9f6f554bbee
crc32: 365E5588
md5: 0175e23c1b04edecb6df3cae50d7bdd3
sha1: f5fd05e2cc57452b8e5e9704c63285e54b139bfd
sha256: f78392a1e52f46a9b283bb70f76984851831af375465ecc9ae77c9f6f554bbee
sha512: 9df84614bc00a3f089fd5b5ca8d306a0769692439dd02d36a6ff4094b498be265b7511c5a1e57bc8c7f48de1b105eec92e3ca047ba25080a78b5a6dff8d6d9ed
ssdeep: 196608:6CSVLtveyn0SMcwAxB0k4dlI6lIlDL7mJcd:LsLtmmjMc5xCk4dlI6yQa
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T138863321581B87B5FCA0E4B70A5D38432E8FFC1A1FF2A640A3D5550BBBBE741B915A07
sha3_384: d1263d5b96c270ba2671b425bb4b65e69b94a66b67f3d9e3bb7ce22c9084f17ef24ac57bc75155aa30eff2c8fe0bd22f
ep_bytes: 558bec83c4c453565733c08945f08945
timestamp: 2023-12-02 22:38:08

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: SupportCD Setup                                             
FileVersion:                     
LegalCopyright:                                                                                                     
ProductName: SupportCD                                                   
ProductVersion:                     
Translation: 0x0000 0x04b0

Trojan:Win32/Ekstak!pz also known as:

How to remove Trojan:Win32/Ekstak!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.