Trojan-Ransom.Win32.Shade.kyo malicious file

The Trojan-Ransom.Win32.Shade.kyo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Ransom.Win32.Shade.kyo virus can do?

• Executable code extraction
• Creates RWX memory
• Attempts to connect to a dead IP:Port (6 unique times)
• Starts servers listening on 127.0.0.1:50498
• Reads data out of its own binary image
• Attempts to delete volume shadow copies
• Installs Tor on the infected machine
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Creates a copy of itself
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

Related domains:

How to determine Trojan-Ransom.Win32.Shade.kyo?

File Info:
crc32: E1C43B94
md5: 0742adcfa45dee809aa4954b2b0014f8
name: 0742ADCFA45DEE809AA4954B2B0014F8.mlw
sha1: 5d37873d923bbe08fa337fd3332456c7a744ee3f
sha256: 0ab70dff3e1d52fe0c77f44bb8431e9b5b8c278820e6fdc5fb8db9737c624b73
sha512: f51f7e91937271dc0d0df893ddaa910ad457d79fbbdc02fe5726d68ef47dd8604ce9ab130d68d6b42a58dea4f13629dd1143b10b2c593417d3913717bd09ce2e
ssdeep: 24576:TlLt9r71Y76VjEFtsor45cH34X1LzOOLoytytctCo7NH:T5ff1A2Yzso85cAFOOLv/YoxH
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
LegalCopyright: http://nsis.sf.net/License
FileVersion: 3.0
FileDescription: NSIS Setup
Translation: 0x0409 0x04b0

Trojan-Ransom.Win32.Shade.kyo also known as:

How to remove Trojan-Ransom.Win32.Shade.kyo?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.