Categories: Malware

VirTool:Win32/Obfuscator.AKT (file analysis)

The VirTool:Win32/Obfuscator.AKT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:Win32/Obfuscator.AKT virus can do?

Possible date expiration check, exits too soon after checking local time
Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Uses Windows utilities for basic functionality
Sniffs keystrokes
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Attempts to disable UAC
Attempts to modify UAC prompt behavior

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine VirTool:Win32/Obfuscator.AKT?


File Info:
crc32: 37E3D830md5: 19472491fd531b40fbc24fe3d1792df2name: 19472491FD531B40FBC24FE3D1792DF2.mlwsha1: a11cc8ccf1a139d4dc6baafb1d12dd8c22bcc231sha256: 4dcd51929f05dc14ae3c42b47dcd6d4e4186d1cd5044448316cddf850fece03asha512: b80b782d99086bd64adfa0e68b088f4e03689877d25dae60710abc5c286de6998d0af153cc69116754c1227294ab5e8e3bf78b7b9fb1a9b9f09a1f0c16f5cf22ssdeep: 12288:W4lsXvtCcmVVXzzn4PJAahPl/QEdIMiVbHydEIJnJWUgaF7IhRq9MmCS:W4lavt0LkLL9IMixoEgeaZIhRq9MmCStype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
Translation: 0x0809 0x04b0

VirTool:Win32/Obfuscator.AKT also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	AIT:Trojan.Nymeria.81
CAT-QuickHeal	TrojanPWS.AutoIt.Zbot.S
Qihoo-360	HEUR/QVM10.1.0A87.Malware.Gen
McAfee	Dropper-AutoIt.e
Malwarebytes	Backdoor.Bladabindi.AutoIt
Sangfor	Malware
CrowdStrike	win/malicious_confidence_80% (D)
BitDefender	AIT:Trojan.Nymeria.81
Arcabit	AIT:Trojan.Nymeria.81
Baidu	Win32.Trojan-Dropper.Autoit.c
Cyren	W32/AutoIt.EZ.gen!Eldorado
Symantec	Backdoor.Ratenjay
APEX	Malicious
Kaspersky	Trojan-Dropper.Win32.Autoit.bpz
NANO-Antivirus	Trojan.Script.AutoIt.dcckyk
Ad-Aware	AIT:Trojan.Nymeria.81
Sophos	ML/PE-A + Troj/Autoit-BIF
F-Secure	Heuristic.HEUR/AGEN.1134155
DrWeb	Trojan.DownLoader11.33994
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.ch
FireEye	Generic.mg.19472491fd531b40
Emsisoft	AIT:Trojan.Nymeria.81 (B)
Avira	HEUR/AGEN.1134155
MAX	malware (ai score=86)
Microsoft	VirTool:Win32/Obfuscator.AKT
ZoneAlarm	Trojan-Dropper.Win32.Autoit.bpz
GData	AIT:Trojan.Nymeria.81 (2x)
Cynet	Malicious (score: 100)
AhnLab-V3	Dropper/RL.Autoit.R243146
BitDefenderTheta	AI:Packer.4A7CAE7C15
ALYac	AIT:Trojan.Nymeria.81
Cylance	Unsafe
ESET-NOD32	multiple detections
Ikarus	Trojan-Dropper.Win32.Autoit
eGambit	Unsafe.AI_Score_75%
Fortinet	W32/Autoit.AWL!tr
AVG	AutoIt:Runner-AN [Trj]
Cybereason	malicious.1fd531
Avast	AutoIt:Runner-AN [Trj]
MaxSecure	Trojan.Malware.300983.susgen