Trojan

Trojan.Glupteba.S17270700 removal guide

Malware Removal

The Trojan.Glupteba.S17270700 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Glupteba.S17270700 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family
  • Creates a copy of itself
  • Deletes executed files from disk
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan.Glupteba.S17270700?


File Info:

name: 0123FF712AFCC8D988D4.mlw
path: /opt/CAPEv2/storage/binaries/a26dbf2be235a2155c4ec68a33e54e6a71c68cbf3c82bd6e9f83e2e340cea2da
crc32: 3B5A69D8
md5: 0123ff712afcc8d988d4e7d7e0011c0f
sha1: 7d10ec28666e70985185468033a6dcfb8ee2ea87
sha256: a26dbf2be235a2155c4ec68a33e54e6a71c68cbf3c82bd6e9f83e2e340cea2da
sha512: 3d9428364853adb2e35f9094a5fada9f5de467561f1678b2efb298b2328c88a10aa7dbb11641dfa8ecfd85cc3cc396736ab8bafa98a0080a4c91e84923103555
ssdeep: 6144:84QQcLAU2W7KUVFFv7BwkGurbc67dANNG8zieDB73sU9wEie+iuv5pvUZASND2Hp:8XpL2oFDBZtrbcol8zie973wEnw3MZCJ
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1B2A4BEDEE6227F6BC2E703B82B5E21E3DA4B76DD025677DA7460018F4EE240425DC66C
sha3_384: 8d29b2f2d0f2a635dc0912bc79fb1ebcfb1b68549ac319587b07cec65e06e7876e67194ee512c4e46e632ec92ffc2f68
ep_bytes: f86b01a1a8028526ade38cb7bfa1e40d
timestamp: 1974-02-09 00:00:00

Version Info:

0: [No Data]

Trojan.Glupteba.S17270700 also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.71586230
FireEyeGeneric.mg.0123ff712afcc8d9
CAT-QuickHealTrojan.Glupteba.S17270700
SkyhighBehavesLike.Win32.Trojan.gc
McAfeeTrojan-FVOQ!0123FF712AFC
MalwarebytesGeneric.Malware.AI.DDS
ZillyaTrojan.Kryptik.Win32.3263580
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0001b3411 )
K7GWTrojan ( 005a45ef1 )
Cybereasonmalicious.12afcc
BitDefenderThetaGen:NN.ZexaF.36802.C4Z@aiNtz3j
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik_AGen.BGU
APEXMalicious
ClamAVWin.Packed.Razy-9873608-0
KasperskyHEUR:Trojan.Win32.Convagent.gen
BitDefenderTrojan.GenericKD.71586230
NANO-AntivirusTrojan.Win32.Selfmod.ivuout
AvastWin32:TrojanX-gen [Trj]
TencentTrojan.Win32.Copak.kq
TACHYONTrojan/W32.Selfmod
EmsisoftTrojan.GenericKD.71586230 (B)
F-SecureTrojan.TR/Crypt.XPACK.Gen
VIPRETrojan.GenericKD.71586230
SophosMal/Inject-GJ
IkarusTrojan-Downloader.Win32.FakeAlert
JiangminTrojan.Selfmod.bbhb
GoogleDetected
AviraTR/Crypt.XPACK.Gen
VaristW32/Trojan.NJGF-3047
Antiy-AVLTrojan/Win32.Kryptik.girh
Kingsoftmalware.kb.a.998
MicrosoftTrojan:Win32/Glupteba.MT!MTB
XcitiumTrojWare.Win32.Kryptik.TLS@812zm8
ArcabitTrojan.Generic.D44451B6 [many]
ZoneAlarmHEUR:Trojan.Win32.Convagent.gen
GDataWin32.Trojan.PSE.11XGYE9
CynetMalicious (score: 100)
AhnLab-V3Packed/Win.FJB.R620290
Acronissuspicious
VBA32Trojan.Khalesi
ALYacTrojan.GenericKD.71586230
MAXmalware (ai score=82)
Cylanceunsafe
PandaTrj/Genetic.gen
RisingTrojan.Kryptik!1.B34D (CLASSIC)
YandexTrojan.Selfmod!NSpQYapoEX4
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Kryptik.GIFQ!tr
AVGWin32:TrojanX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)
alibabacloudVirTool:Win/Kryptik.GIRH

How to remove Trojan.Glupteba.S17270700?

Trojan.Glupteba.S17270700 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment