Categories: Malware

Win32/Injector.DUXT removal

The Win32/Injector.DUXT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.DUXT virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
The binary likely contains encrypted or compressed data.
Crashed cuckoomon during analysis. Report this error to the Github repo.
Anomalous binary characteristics

How to determine Win32/Injector.DUXT?


File Info:
crc32: 40A00A61md5: 837ea0af72583ec75f23d4052feffc84name: 837EA0AF72583EC75F23D4052FEFFC84.mlwsha1: c6d7e142465dbc8be21bfcc4f3454d4c3fa02e26sha256: f9036bea71b5182a4eaa649e16cf282a6af29f9496d9e0aa8ddb4e5ce7329586sha512: a129a89ed4ef6ddc1a6a6a3644a3d19c76efcc2ba9a05be3c88774df9c59db08cdcb2a730d9308f84a452c5b05b612ce00aa9dd41ef710cd7dc2a00e60b2d456ssdeep: 3072:91TQrcnHlXGQmiV6hMoxURVbgPSZ5FTmgVOTpAmeZHoIicrpfAY:5nHoeYMN3bgPSUAvZHbr5Atype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
Translation: 0x0409 0x04b0LegalCopyright: Copyrights 2005-2009 Web Solution Mart, All rights reservedInternalName: chromiumFileVersion: 7.04.0001CompanyName: Web Solution MartLegalTrademarks: WSM  ProductName: Fake WebcamProductVersion: 7.04.0001OriginalFilename: chromium.exe

Win32/Injector.DUXT also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.PonyStealer.nm1@dG8BKQai
FireEye	Generic.mg.837ea0af72583ec7
ALYac	Gen:Heur.PonyStealer.nm1@dG8BKQai
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Generic.4!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Heur.PonyStealer.nm1@dG8BKQai
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.f72583
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:VBCrypt-DIL [Trj]
ClamAV	Win.Trojan.VBPacked-6042739-0
Kaspersky	Trojan.Win32.Khalesi.rx
NANO-Antivirus	Trojan.Win32.Khalesi.evzvod
Tencent	Win32.Trojan.Khalesi.Dzjy
Ad-Aware	Gen:Heur.PonyStealer.nm1@dG8BKQai
Sophos	ML/PE-A + Mal/FareitVB-M
F-Secure	Heuristic.HEUR/AGEN.1129396
DrWeb	Trojan.Inject2.60639
Zillya	Trojan.Khalesi.Win32.142
TrendMicro	TSPY_HPLOKI.SMDS
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Heur.PonyStealer.nm1@dG8BKQai (B)
Ikarus	Trojan.Win32.Khalesi
Avira	HEUR/AGEN.1129396
Antiy-AVL	Trojan/Win32.Khalesi
Microsoft	PWS:Win32/Zbot!ml
Arcabit	Trojan.PonyStealer.E9DB88
ZoneAlarm	Trojan.Win32.Khalesi.rx
GData	Gen:Heur.PonyStealer.nm1@dG8BKQai
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/VBKrypt.RP02.X1828
McAfee	Artemis!837EA0AF7258
MAX	malware (ai score=97)
VBA32	Trojan.Packed
Malwarebytes	MachineLearning/Anomalous.100%
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Injector.DUXT
TrendMicro-HouseCall	TSPY_HPLOKI.SMDS
Yandex	Trojan.Khalesi!3XpbneN3dUg
Fortinet	W32/GenKryptik.ARUE!tr
BitDefenderTheta	Gen:NN.ZevbaF.34804.nm1@aG8BKQai
AVG	Win32:VBCrypt-DIL [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_80% (D)
Qihoo-360	Win32/Trojan.2f3