About "Win32/Injector.EJTI" infection

The Win32/Injector.EJTI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Injector.EJTI virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
At least one IP Address, Domain, or File Name was found in a crypto call
Drops a binary and executes it
Performs some HTTP requests
Unconventionial language used in binary resources: Romanian
The binary likely contains encrypted or compressed data.
Looks up the external IP address
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself
Attempts to create or modify system certificates
Anomalous binary characteristics

Related domains:

api.ipify.org

api.ip.sb

How to determine Win32/Injector.EJTI?


File Info:
crc32: 2794D9FD
md5: 44d623e8d19558bb6e8ad5a9e766c363
name: mini.png
sha1: ea03d5d851e6fcbed16316203ba688dd69f486b5
sha256: 72ed804c6b98ca70f9edf4b5cda9e23a4c42d76ff1334bb71c97387939082c54
sha512: 400dcc0471bd6cbe978f92e904a2157643dfddeaf926c636476954d70f5541bf4fac67bb7d7dc47288cbc66ec9d8ec9f950f567dedc04329ef3a73afeb4ba36a
ssdeep: 6144:vGF3Fx1n8rszp7MBeQ905YmOJD9fT2tQr7zsvqqAj6:OzznfzVN5YmC9fTfYvAu
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
LegalCopyright: Watching
InternalName: bitmapmnu
FileVersion: 1.0.0.22
Comments: easy to understand, cause thats the way
ProductName: bitmapmnu
ProductVersion: 1.0.0.22
OriginalFilename: bitmapmnu.exe

Win32/Injector.EJTI also known as:

Bkav	W32.AIDetectVM.malware
MicroWorld-eScan	Trojan.Agent.EJST
FireEye	Generic.mg.44d623e8d19558bb
Sangfor	Malware
BitDefender	Trojan.Agent.EJST
BitDefenderTheta	Gen:NN.ZevbaF.33558.wm3@ae!1YVlO
Symantec	ML.Attribute.HighConfidence
GData	Trojan.Agent.EJST
Kaspersky	Trojan.Win32.Mansabo.eay
Ad-Aware	Trojan.Agent.EJST
Emsisoft	Trojan.Agent.EJST (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
SentinelOne	DFI – Malicious PE
Trapmine	malicious.moderate.ml.score
APEX	Malicious
Webroot	W32.Trojan.Gen
Endgame	malicious (high confidence)
ZoneAlarm	Trojan.Win32.Mansabo.eay
Acronis	suspicious
MAX	malware (ai score=88)
Cylance	Unsafe
ESET-NOD32	a variant of Win32/Injector.EJTI
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	HEUR/QVM03.0.6717.Malware.Gen

How to remove Win32/Injector.EJTI?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Win32/Injector.EJTI” infection