Ransom • Trojan

What is “Dropped:Trojan.Ransom.TroldeshKD.12647244”?

The Dropped:Trojan.Ransom.TroldeshKD.12647244 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Dropped:Trojan.Ransom.TroldeshKD.12647244 virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Dropped:Trojan.Ransom.TroldeshKD.12647244?


File Info:
crc32: E6046452
md5: b0aa2239094ff5297a4ce8438fc1c6a7
name: B0AA2239094FF5297A4CE8438FC1C6A7.mlw
sha1: c57f6654ab35b8b8899dd6af1d44847911348192
sha256: ed4abf40d595fdf1f46768ded6f10c5f31dff9386cce1ae1e55b2f8efea5b2f7
sha512: 3fbb27f53445196510223cba084825383c4455862c1fbfb8d75499617391798c278a07d4428c23734f48ff66e4a8b1838bf826df23bc8c17fe746e0680d1d02c
ssdeep: 3072:AIWGC7W7BuDcYzI6WxNKAWh7WonAxJbLZcy2wjMBr6b3h+EMaSEwx:uGC7W7BU26A+tnAPbj28MW3BZsx
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
0: [No Data]

Dropped:Trojan.Ransom.TroldeshKD.12647244 also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 004f8c271 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Dropped:Trojan.Ransom.TroldeshKD.12647244
Cylance	Unsafe
Sangfor	Hacktool.Win32.ObfuscatorGd.decblob
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Ransom:Win32/Shade.411ced8b
K7GW	Trojan ( 004f8c271 )
Cybereason	malicious.9094ff
Symantec	Ransom.Nemucod
ESET-NOD32	a variant of Win32/Packed.NSIS.Q
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Win32.Shade.yn
BitDefender	Dropped:Trojan.Ransom.TroldeshKD.12647244
NANO-Antivirus	Trojan.Dos.Code.egouyv
MicroWorld-eScan	Dropped:Trojan.Ransom.TroldeshKD.12647244
Tencent	Win32.Trojan.Shade.Pefq
Ad-Aware	Dropped:Trojan.Ransom.TroldeshKD.12647244
Sophos	Mal/Generic-S
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_LOCKYENC.SMNS1
McAfee-GW-Edition	BehavesLike.Win32.ICLoader.cc
FireEye	Generic.mg.b0aa2239094ff529
Emsisoft	Dropped:Trojan.Ransom.TroldeshKD.12647244 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1102531
Microsoft	Trojan:Win32/Tiggre!rfn
AegisLab	Trojan.Win32.Shade.j!c
GData	Dropped:Trojan.Ransom.TroldeshKD.12647244
McAfee	Artemis!B0AA2239094F
MAX	malware (ai score=98)
VBA32	TrojanRansom.Shade
Panda	Trj/CI.A
TrendMicro-HouseCall	Ransom_LOCKYENC.SMNS1
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Dropped:Trojan.Ransom.TroldeshKD.12647244?

Dropped:Trojan.Ransom.TroldeshKD.12647244 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X