Ransom.Shinolock.2 malicious file

The Ransom.Shinolock.2 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Shinolock.2 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Manipulates data from or to the Recycle Bin
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Attempts to delete or modify volume shadow copies
• Created a process from a suspicious location
• Creates a copy of itself
• Uses suspicious command line tools or Windows utilities

How to determine Ransom.Shinolock.2?

File Info:
name: 7AA245AADB872F5B70DF.mlw
path: /opt/CAPEv2/storage/binaries/bab151c3c0a162e0f9bf5482349ee7ac3d2b3fa3c655a7dfec23b6360b6c0d1b
crc32: 53F85A18
md5: 7aa245aadb872f5b70df84d129e72465
sha1: 2fdf3fd004afc74eef7b9ba5e0d5e8302ce858cf
sha256: bab151c3c0a162e0f9bf5482349ee7ac3d2b3fa3c655a7dfec23b6360b6c0d1b
sha512: 9e4918c1c6976274fbfb30fd759e990eb937d2ce14533c038f6cd1995c6bfac9c031e406585fa5381ffa9e77bfa96e3f0becd666f3bcd29579f893413c818ecd
ssdeep: 3072:R6w9+FrD19ZQb5TJdPrY7zE551QGWiE55k:2ubS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FF14311163EE9695F6F75AB06CB0E0721DB1BD66A931E42D29C03D8F35F1FC48A50B22
sha3_384: 1f5209a6e7ce6738a1ba8e373a8633f39e6d1a8a6676af1fdec7e1914a851920298ab972fbcfebfbf8be0ae2ef8e4a26
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-01-30 14:50:30

Version Info:
Translation: 0x0000 0x04b0
Comments: Ransomeware Simulator
CompanyName: ShinoSec Inc.
FileDescription: ShinoLocker
FileVersion: 1.0.0.1
InternalName: ShinoLockerMain.exe
LegalCopyright: ShinoSec Inc.
LegalTrademarks: ShinoLocker
OriginalFilename: ShinoLockerMain.exe
ProductName: ShinoLocker
ProductVersion: 1.0.0.1
Assembly Version: 1.0.0.1

Ransom.Shinolock.2 also known as:

How to remove Ransom.Shinolock.2?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.