Categories: Malware

VirTool:PowerShell/PsObfus.A removal tips

The VirTool:PowerShell/PsObfus.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:PowerShell/PsObfus.A virus can do?

Executable code extraction
Creates RWX memory
A process created a hidden window
Executed a very long command line or script command which may be indicative of chained commands or obfuscation
A scripting utility was executed
Uses Windows utilities for basic functionality
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine VirTool:PowerShell/PsObfus.A?


File Info:
crc32: FE9C6FD4md5: 31efc1c913c560adbe30c6f6b27034fbname: 31EFC1C913C560ADBE30C6F6B27034FB.mlwsha1: 509925b72421b075d99c99ba9b6173d4e0c5d941sha256: 27356691a6d19212f61add363b75b84bd9cdd374a0ad5075335d8f79b735648fsha512: c6cfd6ca186527b458a08c39aa733cb1719cd928bc42e8efea20de3223fd98aacf5bc9e0e0b06b608bc4d0e0adce080b6abcff5ef14e8af9855acf417994c2b9ssdeep: 1536:47f9h0UPJP/CpICdikMLMLv5PFNg1qrX+VIOlnToIfUgIxutg4Os:WliUPXC8k1nJrX+fNTBf4Gggtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

VirTool:PowerShell/PsObfus.A also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Dropped:Heur.BZC.MTN.Boxter.829.29A85133
FireEye	Generic.mg.31efc1c913c560ad
CAT-QuickHeal	Trojan.Wacatac
McAfee	Artemis!31EFC1C913C5
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Dropped:Heur.BZC.MTN.Boxter.829.29A85133
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.913c56
Cyren	W32/Trojan.IUNU-0892
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Trojan.Win32.PowerShell.bqn
Alibaba	Trojan:Win32/PowerShell.9e811d25
AegisLab	Riskware.Win32.Generic.1!c
Rising	Malware.Heuristic!ET#98% (RDMK:cmRtazqzlcxZjMHDApmxtI/HPuIN)
Ad-Aware	Dropped:Heur.BZC.MTN.Boxter.829.29A85133
Emsisoft	Dropped:Heur.BZC.MTN.Boxter.829.29A85133 (B)
TrendMicro	TROJ_GEN.R002C0WC221
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Sophos	Mal/Generic-S (PUA)
Jiangmin	Trojan.PowerShell.ev
MaxSecure	Trojan.Malware.300983.susgen
Microsoft	VirTool:PowerShell/PsObfus.A
Gridinsoft	Trojan.Win32.CoinMiner.vb!s1
Arcabit	Heur.BZC.MTN.Boxter.829.29A85133
ZoneAlarm	Trojan.Win32.PowerShell.bqn
GData	Dropped:Heur.BZC.MTN.Boxter.829.29A85133
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4348974
ALYac	Dropped:Heur.BZC.MTN.Boxter.829.29A85133
MAX	malware (ai score=80)
Malwarebytes	Malware.Heuristic.1008
Zoner	Trojan.Win32.73853
ESET-NOD32	a variant of Generik.LTRSLNG
TrendMicro-HouseCall	TROJ_GEN.R002C0WC221
Tencent	Win32.Trojan.Powershell.Lkod
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	Riskware/PowerShell
AVG	Win32:Trojan-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Win32/Trojan.Generic.HgIASPwA