Malware

About “Win32/Injector.ELDB” infection

Malware Removal

The Win32/Injector.ELDB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Injector.ELDB virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Deletes its original binary from disk
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Steals private information from local Internet browsers
  • Creates a hidden or system file
  • Creates a copy of itself
  • Harvests credentials from local FTP client softwares
  • Harvests information related to installed instant messenger clients
  • Harvests information related to installed mail clients
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
mecharnise.ir

How to determine Win32/Injector.ELDB?


File Info:

crc32: 8995A1F7
md5: 34fa12f9f44f6db912f6457003faba4a
name: bbb.exe
sha1: 5afa18f6e8a14f3e4f364d2efefbfe6b0198e361
sha256: c9f2ba8d2fcdf0b87e01eae922de1c147dcb52337b437cc2476cdc51a27a3a2a
sha512: c2cfb25cf303b644940f1430ca926abad3b980534ef9567d612ca97fa88b0463190a0c374c47bf1abc8e5438b39ef6d7b404adfd74110f9dbc5a2dec03ee93fd
ssdeep: 12288:Sbr3eBiwRUDMGCwxrHlwwkDOxZ07b1HO+a+wu:Qje1RUD5R0Y21nqu
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Win32/Injector.ELDB also known as:

MicroWorld-eScanTrojan.GenericKD.33551496
FireEyeGeneric.mg.34fa12f9f44f6db9
ALYacSpyware.AgentTesla
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKD.33551496
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.6e8a14
Invinceaheuristic
F-ProtW32/Trojan3.AOZQ
SymantecTrojan Horse
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.LokiBot-7624520-0
GDataTrojan.GenericKD.33551496
KasperskyHEUR:Trojan-PSW.Win32.Agensla.gen
AlibabaTrojan:Win32/DelfInject.ali2000015
NANO-AntivirusTrojan.Win32.Agensla.hfgsgj
AegisLabTrojan.Win32.Malicious.4!c
RisingTrojan.Injector!1.AF18 (CLASSIC)
Ad-AwareTrojan.GenericKD.33551496
EmsisoftTrojan.GenericKD.33551496 (B)
DrWebTrojan.PWS.Stealer.28239
TrendMicroTrojanSpy.Win32.LOKI.SMDF.hp
McAfee-GW-EditionBehavesLike.Win32.Fareit.jh
Trapminemalicious.high.ml.score
SophosMal/Fareit-V
SentinelOneDFI – Suspicious PE
CyrenW32/Trojan.QNIJ-6349
JiangminTrojan.PSW.Agensla.dd
WebrootW32.Trojan.Gen
MAXmalware (ai score=81)
Antiy-AVLTrojan[PSW]/Win32.Agensla
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D1FFF488
ZoneAlarmHEUR:Trojan-PSW.Win32.Agensla.gen
MicrosoftTrojan:Win32/FormBook.AQ!MTB
AhnLab-V3Trojan/Win32.Lokibot.C4018337
Acronissuspicious
McAfeeArtemis!34FA12F9F44F
VBA32Trojan.Wacatac
MalwarebytesTrojan.MalPack.DLF
PandaTrj/CI.A
ESET-NOD32a variant of Win32/Injector.ELDB
TrendMicro-HouseCallTrojanSpy.Win32.LOKI.SMDF.hp
TencentWin32.Backdoor.Lokibot.Auto
IkarusTrojan.Inject
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Injector.EESQ!tr
BitDefenderThetaGen:NN.ZelphiF.34100.NGW@a0ciPYdi
AVGWin32:RATX-gen [Trj]
AvastWin32:RATX-gen [Trj]
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Win32/Trojan.PSW.086

How to remove Win32/Injector.ELDB?

Win32/Injector.ELDB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment