Categories: Trojan

Win32/TrojanDownloader.Tovkater.BT malicious file

The Win32/TrojanDownloader.Tovkater.BT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.Tovkater.BT virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
Reads data out of its own binary image
Performs some HTTP requests
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Creates a hidden or system file
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

a.tomx.xyz

daub.unnotable.ru

ec2-54-154-5-3.eu-west-1.compute.amazonaws.com

www.bing.com

How to determine Win32/TrojanDownloader.Tovkater.BT?


File Info:
crc32: 97DCF6EFmd5: 0bc196e4a6480eb6dcc94ea4cfd6f7d5name: 0BC196E4A6480EB6DCC94EA4CFD6F7D5.mlwsha1: 4283b41e7fb9d80c4cfe57082088f40ee400bbddsha256: dd27075ae55d409558773b0bca87bfc8add363ee6a10e4f1046685c2360da90fsha512: ba39d8408fc099c4e83d1e3a1695a2f38251a3570496ca6e5ed8f59a0673659b3c595850137ccc40adf931ceeb9f2c5e24afa830a16b8b5854191a2ad49286edssdeep: 12288:RfHYurhVmLnAns3dVnxYTx3YVh/VlxVVH5EkrGTruml5RYlrlNFr7:RAuFVmLnAns3dVnxYTx3YVh/VlxVVH5ttype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
LegalCopyright: nLegalInternalName: vInternalFileVersion: 14.230.230.10CompanyName: xPabloProductName: fNameProductVersion: 123.120.110.10FileDescription: cPicassoOriginalFilename: mOriginalTranslation: 0x0800 0x04b0

Win32/TrojanDownloader.Tovkater.BT also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader25.14525
MicroWorld-eScan	Gen:Variant.Strictor.142521
FireEye	Generic.mg.0bc196e4a6480eb6
CAT-QuickHeal	Adware.Dataric.A5
ALYac	Gen:Variant.Strictor.142521
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan-Downloader ( 005147ee1 )
BitDefender	Gen:Variant.Strictor.142521
K7GW	Trojan-Downloader ( 005134e71 )
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	Gen:NN.ZexaF.34804.FmMfaybWrQhG
Cyren	W32/TOVus.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMalware
Kaspersky	not-a-virus:HEUR:AdWare.Win32.Generic
NANO-Antivirus	Trojan.Win32.InstMonster.erlxzq
AegisLab	Trojan.Win32.Generic.4!c
Tencent	Malware.Win32.Gencirc.10b0ebf4
Ad-Aware	Gen:Variant.Strictor.142521
Sophos	Mal/Generic-S
Comodo	Application.Win32.InstallMonster.BW@7e3x2m
F-Secure	Adware.ADWARE/InstMonster.Gen7
Zillya	Downloader.Tovkater.Win32.318
TrendMicro	HT_TOVKATER_GG31089C.UVPM
McAfee-GW-Edition	BehavesLike.Win32.Trojan.hh
Emsisoft	Gen:Variant.Strictor.142521 (B)
SentinelOne	Static AI – Malicious PE – Downloader
GData	Gen:Variant.Strictor.142521
Jiangmin	AdWare.TOVus.u
Avira	ADWARE/InstMonster.Gen7
Antiy-AVL	GrayWare[AdWare]/Win32.AGeneric
Arcabit	Trojan.Strictor.D22CB9
ZoneAlarm	not-a-virus:HEUR:AdWare.Win32.Generic
Microsoft	Program:Win32/Wacapew.C!ml
Cynet	Malicious (score: 100)
AhnLab-V3	PUP/Win32.InstMonster.R205788
McAfee	GenericRXAA-AA!0BC196E4A648
MAX	malware (ai score=84)
VBA32	BScope.Trojan.Downloader
Malwarebytes	Generic.Trojan.Malicious.DDS
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/TrojanDownloader.Tovkater.BT
TrendMicro-HouseCall	HT_TOVKATER_GG31089C.UVPM
Rising	Downloader.Tovkater!8.E5CE (TFE:5:ooeEv0JepeL)
Yandex	Trojan.GenAsa!oEIUVCsWqrs
Ikarus	Trojan-Downloader.Win32.Tovkater
Fortinet	W32/Tovkater.CD!tr.dldr
AVG	FileRepMalware
Cybereason	malicious.4a6480
Paloalto	generic.ml
Qihoo-360	Win32/Virus.Adware.b51