Win32/RiskWare.CobaltStrike.Artifact.D information

The Win32/RiskWare.CobaltStrike.Artifact.D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/RiskWare.CobaltStrike.Artifact.D virus can do?

Executable code extraction
Creates RWX memory
Anomalous binary characteristics

How to determine Win32/RiskWare.CobaltStrike.Artifact.D?


File Info:
crc32: 631D8619
md5: aeb7e590c71950fd4f75f4093a7e26a9
name: AEB7E590C71950FD4F75F4093A7E26A9.mlw
sha1: 4625c3d7f87b4a981e368123d93f3c624a9fff4c
sha256: 434c246d2be81c0a28aea4b865656de223e083ce670581843cff4c67d66da0cc
sha512: c3fcf0aeab3c4df8feb9cfe89fbeeb5d30ff902850d1afd823ac925b3796db4cd21121fa7a7ac103097eb19364c11e15b857b4a438bc0b4f6509ebf1c4d3816a
ssdeep: 3072:lSEQw/mIOfSAAmLGGxR1pB0lxZ0J9FIRKmj8q2Jclf3tcw:lSEQ8IXqOR3B0lxqJ9oK08q2+pCw
type: PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:
0: [No Data]

Win32/RiskWare.CobaltStrike.Artifact.D also known as:

Elastic	malicious (high confidence)
ClamAV	Win.Countermeasure.LoaderWinGeneric-9804845-2
ALYac	Gen:Trojan.Heur.rK4@Iz7BIT
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
BitDefender	Gen:Trojan.Heur.rK4@Iz7BIT
K7GW	Riskware ( 0049f6ae1 )
K7AntiVirus	Riskware ( 0049f6ae1 )
Symantec	Backdoor.Cobalt!gm1
ESET-NOD32	a variant of Win32/RiskWare.CobaltStrike.Artifact.D.gen
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win64.Cobalt.gen
MicroWorld-eScan	Gen:Trojan.Heur.rK4@Iz7BIT
Ad-Aware	Gen:Trojan.Heur.rK4@Iz7BIT
Sophos	ATK/Cobalt-W
BitDefenderTheta	AI:Packer.639A67581A
TrendMicro	Trojan.Win32.LOADER.SM
McAfee-GW-Edition	Injector-FEY.c!AEB7E590C719
FireEye	Generic.mg.aeb7e590c71950fd
Emsisoft	Gen:Trojan.Heur.rK4@Iz7BIT (B)
SentinelOne	Static AI – Suspicious PE
Avira	TR/Crypt.XDR.Gen
ZoneAlarm	HEUR:Trojan.Win64.Cobalt.gen
GData	Gen:Trojan.Heur.rK4@Iz7BIT
McAfee	Injector-FEY.c!AEB7E590C719
MAX	malware (ai score=81)
VBA32	BScope.Trojan.Swrort
Malwarebytes	Trojan.Loader.Feye.Generic
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.LOADER.SM

How to remove Win32/RiskWare.CobaltStrike.Artifact.D?

Win32/RiskWare.CobaltStrike.Artifact.D removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X