Categories: Malware

Should I remove “VirTool:Win32/DelfInject!AH”?

The VirTool:Win32/DelfInject!AH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/DelfInject!AH virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Injection with CreateRemoteThread in a remote process
Creates RWX memory
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Spoofs its process name and/or associated pathname to appear as a legitimate process
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine VirTool:Win32/DelfInject!AH?


File Info:
crc32: 7AB737B9md5: ccb994a6bca84d950698bbd4d552284cname: service.exesha1: 2054d566a5226a93ff7595cb784ab4916a0157e6sha256: 3d375c40a687f30a48ac403b22514f14ab114fa34a5f77fe6555d1a46c42d9f4sha512: 02741df21d159c1e766e1c07a7c085cd3a51ead7e471de28f3b982bb05925091264930b548ed525842c92f4336329e85c6fd796b77b04bb077eebde2ce800bbessdeep: 3072:hP5zw1uB0KCffl6CFxw3AAxUSEkSqLQj2Bex3Va5SNBI7s/UtbThDuJgPW8rtO6:hP1w153l6CFyCSE1qL1+agBI7ZbFueHtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

VirTool:Win32/DelfInject!AH also known as:

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.NTPacker
FireEye	Generic.mg.ccb994a6bca84d95
McAfee	W32/Sdbot.cf.gen
Cylance	Unsafe
VIPRE	RiskTool.Win32.ProcessPatcher.Nor!cobra (v) (not malicious)
Sangfor	Malware
BitDefender	Trojan.NTPacker
Cybereason	malicious.6bca84
TrendMicro	BKDR_BIFROSE.A
F-Prot	W32/Spybot.PHL
Symantec	W32.IRCBot
TotalDefense	Win32/Tnega.APVC
APEX	Malicious
Avast	Win32:Agent-DEI [Trj]
ClamAV	Win.Dropper.Delf-564
GData	Trojan.NTPacker
Kaspersky	Packed.Win32.CPEX-based.c
Alibaba	TrojanDropper:Win32/CPEX-based.e6668f73
NANO-Antivirus	Trojan.Win32.NtRootKit.fllajz
ViRobot	Dropper.Agent.1142784
AegisLab	Trojan.Win32.Rbot.leZz
Endgame	malicious (high confidence)
Emsisoft	Trojan.NTPacker (B)
Comodo	TrojWare.Win32.TrojanDropper.ErPack@4hsl
F-Secure	Rogue:W32/FakeAv.BI
DrWeb	Trojan.NtRootKit.40
Zillya	Backdoor.CPEX.Win32.1888
Invincea	heuristic
Trapmine	malicious.moderate.ml.score
Sophos	W32/Rbot-Gen
Ikarus	Backdoor.Win32.Prorat
Cyren	W32/DelfInject.A.gen!Eldorado
Jiangmin	TrojanDropper.Delf.hb
Webroot	W32.Dropper.Gen
Avira	WORM/Mytob.FH
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Packed]/Win32.CPEX-based
Arcabit	Trojan.NTPacker
ZoneAlarm	Packed.Win32.CPEX-based.c
Microsoft	VirTool:Win32/DelfInject.gen!AH
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Bifrose.C72278
Acronis	suspicious
VBA32	Malware-Cryptor.Inject.gen
ALYac	Trojan.NTPacker
Ad-Aware	Trojan.NTPacker
Panda	Generic Malware
ESET-NOD32	Win32/TrojanDropper.ErPack
TrendMicro-HouseCall	BKDR_BIFROSE.A
Rising	Backdoor.Win32.Rbot.a (CLASSIC)
Yandex	Trojan.Spybot!6BBWThPL6Y8
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Injector.fam!tr
BitDefenderTheta	AI:Packer.45B891371B
AVG	Win32:Agent-DEI [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Generic/HEUR/QVM41.2.001B.Malware.Gen