About “VirTool:Win32/DelfInject!X” infection

Malware Removal

The VirTool:Win32/DelfInject!X is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What VirTool:Win32/DelfInject!X virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • Expresses interest in specific running processes
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Executed a process and injected code into it, probably while unpacking
  • Code injection with CreateRemoteThread in a remote process
  • Deletes its original binary from disk
  • Installs itself for autorun at Windows startup
  • Attempts to identify installed AV products by installation directory
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine VirTool:Win32/DelfInject!X?


File Info:

crc32: 79935631
md5: a1282707c6a4e0f48bbc7b02a5c3dd7e
name: A1282707C6A4E0F48BBC7B02A5C3DD7E.mlw
sha1: 42b2c1ced0a214824be3239ff54d928ea84adcc0
sha256: 5baa42cc2a429dbca3ec23391be0696e049d2e1fb16d4270a5317266967e8238
sha512: 5320b8f3c4b1aadad58081b3e86deedaf813199a13408fbbb110831a35753f1f794a60b7a81853398d7d475e23e31cccb23b0d30be94e5184a472d352d5b4b4d
ssdeep: 6144:Tn7xj4rwN6s38Qxjsel0AY1OVLBEvaZyFVAq613Ps8r53Ws:/xj4rsvNOOVLB0NFVyz3Ws
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

VirTool:Win32/DelfInject!X also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Bulz.171429
ALYacGen:Variant.Bulz.171429
CylanceUnsafe
VIPREFraudTool.Win32.MSRemovalTool.ek!a (v)
SangforMalware
BitDefenderGen:Variant.Bulz.171429
CrowdStrikewin/malicious_confidence_100% (D)
CyrenW32/BestaFera.E.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:TrojanX-gen [Trj]
ClamAVWin.Malware.Vimditator-9787653-0
KasperskyUDS:DangerousObject.Multi.Generic
RisingTrojan.Clicker.Delf!1.64DF (CLASSIC)
Ad-AwareGen:Variant.Bulz.171429
SophosTroj/Agent-AJFK
F-SecureHeuristic.HEUR/AGEN.1100661
DrWebTrojan.DownLoader25.55541
InvinceaML/PE-A + Troj/Agent-AJFK
McAfee-GW-EditionBehavesLike.Win32.Generic.vz
FireEyeGeneric.mg.a1282707c6a4e0f4
EmsisoftGen:Variant.Bulz.171429 (B)
IkarusVirus.Win32.DelfInject
AviraHEUR/AGEN.1100661
MicrosoftVirTool:Win32/DelfInject.gen!X
ArcabitTrojan.Bulz.D29DA5
GDataGen:Variant.Bulz.171429
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.RL_Vimditator.R354626
McAfeeGenericRXAA-FA!A1282707C6A4
MAXmalware (ai score=86)
VBA32BScope.Trojan.AVKill
ESET-NOD32a variant of Win32/Delf.OKR
YandexTrojan.GenAsa!2N75yrcj3Hk
SentinelOneStatic AI – Malicious PE
MaxSecureWin.MxResIcn.Heur.Gen
BitDefenderThetaGen:NN.ZelphiF.34634.@JZ@aaBOm0jb
AVGWin32:TrojanX-gen [Trj]
Cybereasonmalicious.ed0a21
Qihoo-360HEUR/QVM20.1.595E.Malware.Gen

How to remove VirTool:Win32/DelfInject!X?

VirTool:Win32/DelfInject!X removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment