Win32/RiskWare.CobaltStrike.Artifact.D (file analysis)

The Win32/RiskWare.CobaltStrike.Artifact.D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/RiskWare.CobaltStrike.Artifact.D virus can do?

Executable code extraction
Creates RWX memory
Anomalous binary characteristics

How to determine Win32/RiskWare.CobaltStrike.Artifact.D?


File Info:
crc32: A930F902
md5: aac9563a55d8b670f06b410ab0c63c50
name: AAC9563A55D8B670F06B410AB0C63C50.mlw
sha1: 4bbc3354bd88bd367dd557076f38274e224a461d
sha256: c3163389f8926bb33178e27ad11af95395955da44380a4ffd84ef7f8af135c1e
sha512: e245ccd797e0ea113d79190ed63cff14117ccf02c78cc212598a54050be25525dd814748a8040e906b3f2140329fa3108325a378a0f8e118af74ab5e957e09e7
ssdeep: 3072:rSEQw/mIOfSAAmLGGxR1pB0lxZ0J9FIRKmj8q2Jclf3tcw:rSEQ8IXqOR3B0lxqJ9oK08q2+pCw
type: PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:
0: [No Data]

Win32/RiskWare.CobaltStrike.Artifact.D also known as:

Elastic	malicious (high confidence)
ClamAV	Win.Countermeasure.LoaderWinGeneric-9804845-2
ALYac	Gen:Trojan.Heur.rK4@IfSRXuj
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
BitDefender	Gen:Trojan.Heur.rK4@IfSRXuj
K7GW	Riskware ( 0049f6ae1 )
K7AntiVirus	Riskware ( 0049f6ae1 )
Symantec	Backdoor.Cobalt!gm1
ESET-NOD32	a variant of Win32/RiskWare.CobaltStrike.Artifact.D.gen
APEX	Malicious
Cynet	Malicious (score: 100)
MicroWorld-eScan	Gen:Trojan.Heur.rK4@IfSRXuj
Ad-Aware	Gen:Trojan.Heur.rK4@IfSRXuj
Sophos	ATK/Cobalt-W
BitDefenderTheta	AI:Packer.117053B11B
TrendMicro	Trojan.Win32.LOADER.SM
McAfee-GW-Edition	Injector-FEY.c!AAC9563A55D8
FireEye	Generic.mg.aac9563a55d8b670
Emsisoft	Gen:Trojan.Heur.rK4@IfSRXuj (B)
SentinelOne	Static AI – Suspicious PE
Avira	TR/Crypt.XDR.Gen
Arcabit	Trojan.Heur.E4D029
AegisLab	Trojan.Win64.Cobalt.4!c
GData	Gen:Trojan.Heur.rK4@IfSRXuj
McAfee	Injector-FEY.c!AAC9563A55D8
MAX	malware (ai score=89)
VBA32	BScope.Trojan.Swrort
Malwarebytes	Trojan.Loader.Feye.Generic
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.LOADER.SM

How to remove Win32/RiskWare.CobaltStrike.Artifact.D?

Win32/RiskWare.CobaltStrike.Artifact.D removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X