Malware

VirTool:Win32/AutInject.X information

Malware Removal

The VirTool:Win32/AutInject.X is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What VirTool:Win32/AutInject.X virus can do?

  • Sample contains Overlay data
  • Reads data out of its own binary image
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family
  • Binary file triggered YARA rule
  • Anomalous binary characteristics
  • Yara detections observed in process dumps, payloads or dropped files

How to determine VirTool:Win32/AutInject.X?


File Info:

name: CEDBBF5C5E092A70B65D.mlw
path: /opt/CAPEv2/storage/binaries/78241a17a8d2563ce84f11b10ad5cd58e2a79d0febb8080cfeaa349f230c9f43
crc32: 35204864
md5: cedbbf5c5e092a70b65de74e75be2590
sha1: eb5a2aad4373bb1182a6175a57f002760bdd6056
sha256: 78241a17a8d2563ce84f11b10ad5cd58e2a79d0febb8080cfeaa349f230c9f43
sha512: 00431f6da417ccdece7a610d4c852674711a4489f42a87850e53a19c3885b470c619ecb5e38a077ee35e5207faec7f47872bb153b723f6351bf809eec86cf10e
ssdeep: 12288:QhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aM/VIJIeCI:YRmJkcoQricOIQxiZY1iaMwCI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1ED05BF21F5C59036C5A323B19E7EF76A963D6D3A0336D19B27C83D215EB11412B3AB23
sha3_384: ffee9f2c71156b850e33719cc3376df169e92abc9e154587cb31c63521c6783bed74d6b59c4f10193f50957fb505b277
ep_bytes: e816900000e989feffffcccccccccc55
timestamp: 2012-01-29 21:32:28

Version Info:

FileDescription:
FileVersion: 3, 3, 8, 1
CompiledScript: AutoIt v3 Script: 3, 3, 8, 1
Translation: 0x0809 0x04b0

VirTool:Win32/AutInject.X also known as:

BkavW32.AIDetectMalware
AVGAutoIt:Injector-ED [Trj]
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Trojan.Heur.AutoIT.10
CAT-QuickHealTrojanSpy.Zbot.A4
SkyhighBehavesLike.Win32.Ransomware.ch
McAfeePWSZbot-FFJ!CEDBBF5C5E09
MalwarebytesMalware.AI.3717896852
VIPREGen:Trojan.Heur.AutoIT.10
SangforSpyware.Win32.Autoit.V1s2
K7AntiVirusTrojan ( 0055e3991 )
AlibabaTrojan:Win32/Predator.ali2000022
K7GWTrojan ( 0055e3991 )
SymantecTrojan.Gen.2
ESET-NOD32a variant of Win32/Injector.DMUI
CynetMalicious (score: 100)
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.Zbot-6988460-0
KasperskyTrojan-Spy.Win32.Zbot.okcp
BitDefenderGen:Trojan.Heur.AutoIT.10
NANO-AntivirusTrojan.Win32.Zbot.cwbiip
AvastAutoIt:Injector-ED [Trj]
EmsisoftGen:Trojan.Heur.AutoIT.10 (B)
F-SecureDropper.DR/AutoIt.Gen
DrWebTrojan.Proxy.25849
TrendMicroTROJ_GEN.R002C0CBN24
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.cedbbf5c5e092a70
SophosW32/AutoIt-WI
SentinelOneStatic AI – Malicious PE
AviraDR/AutoIt.Gen
MAXmalware (ai score=100)
KingsoftWin32.Hack.DarkKomet.ayhu
MicrosoftVirTool:Win32/AutInject.X
XcitiumMalware@#2uw64tnucf8oz
ArcabitTrojan.Heur.AutoIT.10
ZoneAlarmTrojan-Spy.Win32.Zbot.okcp
GDataGen:Trojan.Heur.AutoIT.10
GoogleDetected
AhnLab-V3Spyware/Win32.Zbot.C183684
BitDefenderThetaAI:Packer.D7D05DD419
ALYacGen:Trojan.Heur.AutoIT.10
VBA32Trojan.Autoit.Paket
Cylanceunsafe
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_GEN.R002C0CBN24
TencentWin32.Trojan-Spy.Zbot.Qqil
IkarusWorm.Win32.AutoIt
MaxSecureTrojan.Autoit.AZA
DeepInstinctMALICIOUS
alibabacloudMalware

How to remove VirTool:Win32/AutInject.X?

VirTool:Win32/AutInject.X removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment