What is "Win32/Injector.Autoit.FEL"?

The Win32/Injector.Autoit.FEL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.Autoit.FEL virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process attempted to delay the analysis task.
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Sniffs keystrokes
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
Exhibits behavior characteristic of iSpy Keylogger
Checks the CPU name from registry, possibly for anti-virtualization

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Injector.Autoit.FEL?


File Info:
crc32: D3FADFAE
md5: 4e0399b111a189e44d78db7c1637dd3e
name: tosco.exe
sha1: 8b468af267a200949298b792b729f139f673d4b0
sha256: 6db6e544c7cc5a1ada1be4e2527fd7bec60f42882a7b033986b449ca07c2066f
sha512: 6a60221f275348541ab5071c33953d9b39af1b8dc0d7c89c44882cfd225a69cef1bffab15235a3d74d4551c43c9638b80ea022a9664a0aa12310f005343b3363
ssdeep: 49152:xh+ZkldoPKi2azo1sphvtEO/Alu6v2BegggwyT:y2cPKiE1sphvt5/AlLbGwy
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0809 0x04b0

Win32/Injector.Autoit.FEL also known as:

Bkav	W32.AIDetectVM.malware2
MicroWorld-eScan	Trojan.AutoIT.Agent.AAJ
FireEye	Generic.mg.4e0399b111a189e4
Qihoo-360	HEUR/QVM10.1.2161.Malware.Gen
Sangfor	Malware
BitDefender	Trojan.AutoIT.Agent.AAJ
Cybereason	malicious.267a20
Cyren	W32/AutoIt.KF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Script:SNH-gen [Trj]
GData	Trojan.AutoIT.Agent.AAJ
Kaspersky	UDS:DangerousObject.Multi.Generic
Tencent	Win32.Trojan.Inject.Auto
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.vc
Trapmine	malicious.moderate.ml.score
Emsisoft	Trojan.AutoIT.Agent.AAJ (B)
Ikarus	Trojan.Autoit
F-Prot	W32/AutoIt.KF.gen!Eldorado
Antiy-AVL	GrayWare/Autoit.BinToStr.a
Endgame	malicious (high confidence)
Arcabit	Trojan.AutoIT.Agent.AAJ
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Predator.BD!MTB
AhnLab-V3	Trojan/AU3.Wacatac.S1079
Acronis	suspicious
McAfee	Artemis!4E0399B111A1
MAX	malware (ai score=86)
ESET-NOD32	a variant of Win32/Injector.Autoit.FEL
eGambit	Unsafe.AI_Score_99%
Fortinet	AutoIt/Injector.FEE!tr
AVG	Script:SNH-gen [Trj]
Paloalto	generic.ml
MaxSecure	Trojan.Malware.300983.susgen

How to remove Win32/Injector.Autoit.FEL?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “Win32/Injector.Autoit.FEL”?