About "Exploit.Win32.Shellcode.xew" infection

The Exploit.Win32.Shellcode.xew is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Exploit.Win32.Shellcode.xew virus can do?

Executable code extraction
Creates RWX memory
Attempts to connect to a dead IP:Port (5 unique times)
Performs some HTTP requests
Unconventionial language used in binary resources: Ukrainian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Steals private information from local Internet browsers
Attempts to access Bitcoin/ALTCoin wallets
Attempts to create or modify system certificates
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

telete.in

apps.identrust.com

trashbininspector.fun

How to determine Exploit.Win32.Shellcode.xew?


File Info:
crc32: 8A96554B
md5: 5f26cbfdec8afdb730c1a7729adf69d1
name: 5F26CBFDEC8AFDB730C1A7729ADF69D1.mlw
sha1: 8739df80f68c0c3188e76752553122c6150cea08
sha256: f40c77a22e3ec01343290ceab219f059bbde44af897e2949e779fb827720a5a4
sha512: 32f94f81b62516f7148180acd0a7dc1b46f51f9530e54699f95f5e7386c6f2542df2c46eb9c30d587a61cf10d82ee598c5c7f33d62381fa8aaebe1f43b7f4d83
ssdeep: 6144:vEjg6LHXyeJhAj2xkW1+6KifbV4OwrV9aNGbVUwaOpX/xljh7lVM54vTHPfIu7b:vOhhQEaoz+d/VUTiv97lqGr3Iu7T8
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
InternalSurname: debaukd.ekze
Prod: 1.2.7
FileVersions: 1.0.5.6
LegalCo: Copyri (C) 2019, permudationzi

Exploit.Win32.Shellcode.xew also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.35913168
CAT-QuickHeal	Trojan.Multi
McAfee	RDN/Generic.grp
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005756421 )
BitDefender	Trojan.GenericKD.35913168
K7GW	Trojan ( 005756421 )
Cybereason	malicious.0f68c0
Cyren	W32/Trojan.KFFB-6183
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
Kaspersky	Exploit.Win32.Shellcode.xew
Alibaba	Trojan:Win32/Shellcode.b37193e2
ViRobot	Trojan.Win32.Z.Agent.463872.ZP
AegisLab	Trojan.Multi.Generic.4!c
Tencent	Win32.Exploit.Shellcode.Sxes
Ad-Aware	Trojan.GenericKD.35913168
Emsisoft	Trojan.Crypt (A)
Comodo	Malware@#3tnm5d9k7e2s4
F-Secure	Trojan.TR/Crypt.Agent.btpuj
DrWeb	Trojan.Siggen11.56849
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
FireEye	Generic.mg.5f26cbfdec8afdb7
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_95%
Avira	TR/Crypt.Agent.btpuj
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:Win32/Zenpack.MU!MTB
Gridinsoft	Trojan.Win32.Packed.oa
Arcabit	Trojan.Generic.D223FDD0
ZoneAlarm	Exploit.Win32.Shellcode.xew
GData	Trojan.GenericKD.35913168
Cynet	Malicious (score: 100)
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34700.CmGfaWTqLpgc
ALYac	Trojan.GenericKD.35913168
MAX	malware (ai score=99)
VBA32	Trojan.Azorult
Malwarebytes	Trojan.MalPack.GS
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HILR
TrendMicro-HouseCall	TROJ_GEN.R002H0CLT20
Rising	Backdoor.Agent!8.C5D (TFE:5:IhzqwXEXQUL)
Ikarus	Trojan.SuspectCRC
Fortinet	W32/Kryptik.HGHW!tr
AVG	Win32:DropperX-gen [Drp]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Generic/HEUR/QVM11.1.3D82.Malware.Gen

How to remove Exploit.Win32.Shellcode.xew?

Exploit.Win32.Shellcode.xew removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Exploit.Win32.Shellcode.xew” infection