Categories: Malware

VirTool:Win32/Obfuscator.ADR removal tips

The VirTool:Win32/Obfuscator.ADR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/Obfuscator.ADR virus can do?

Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Executed a process and injected code into it, probably while unpacking
Attempts to repeatedly call a single API many times in order to delay analysis time
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine VirTool:Win32/Obfuscator.ADR?


File Info:
crc32: 25C748A8md5: 4edcc90dfd3d0f19126cdb0595588a59name: 4EDCC90DFD3D0F19126CDB0595588A59.mlwsha1: 120b8f102c3a0631f1fc8d3a62c2ff3ee6558d08sha256: 9c14b7db90e63f57457c16d4dcb0186d8c94d6c9b3058265f3604d8508878ec9sha512: 8ef049940a23e3eb483c64b8ad78d39ccb2a08a65514d428bb96f69f8ed8b021fc9205670c6c9a6b80fff2297842ecfbb337e52cc0a4063dac25426d3282edbfssdeep: 1536:uakVWmqqg3qzlB1uzbKEfbh47Ybw15zxPmbsLGMGQJKL5UP9vvvSEHSCR:ualmqd3qBcfb/wPz4bq0gv3JyCtype: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Version Info:
0: [No Data]

VirTool:Win32/Obfuscator.ADR also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Riskware ( 0040eff71 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Symmi.8604
Cylance	Unsafe
Sangfor	Ransom.Win32.Foreign.sb
CrowdStrike	win/malicious_confidence_80% (D)
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.dfd3d0
Symantec	Trojan.Shylock
ESET-NOD32	a variant of Win32/Injector.ZHO
APEX	Malicious
Avast	Win32:Crypt-OJD [Trj]
Kaspersky	UDS:Trojan-Ransom.Win32.Foreign.sb
BitDefender	Gen:Variant.Symmi.8604
NANO-Antivirus	Trojan.Win32.Zbot.dernvl
MicroWorld-eScan	Gen:Variant.Symmi.8604
Tencent	Win32.Trojan.Ransom.Piau
Ad-Aware	Gen:Variant.Symmi.8604
Sophos	ML/PE-A + Mal/EncPk-AHQ
Comodo	TrojWare.Win32.PWS.ZBot.AAA@4sq88d
BitDefenderTheta	AI:Packer.6D671E9C1F
VIPRE	Trojan-PWS.Win32.Zbot.aaa (v)
TrendMicro	TROJ_RANSOM.SMWX
McAfee-GW-Edition	PWS-Zbot.gen.arb
FireEye	Generic.mg.4edcc90dfd3d0f19
Emsisoft	Gen:Variant.Symmi.8604 (B)
SentinelOne	Static AI – Suspicious PE
Avira	TR/Dropper.Gen7
Antiy-AVL	Trojan/Generic.ASMalwS.23D5402
Microsoft	VirTool:Win32/Obfuscator.ADR
GData	Gen:Variant.Symmi.8604
AhnLab-V3	Trojan/Win32.Gen
McAfee	PWS-Zbot.gen.arb
MAX	malware (ai score=80)
Panda	Generic Malware
TrendMicro-HouseCall	TROJ_RANSOM.SMWX
Rising	Dropper.Generic!8.35E (CLOUD)
Yandex	Trojan.Symmi!Bw1nwSJP8jU
Ikarus	Trojan-Ransom.Foreign
Fortinet	W32/Yakes.BKEJ!tr
AVG	Win32:Crypt-OJD [Trj]
Paloalto	generic.ml