About “Trojan.ScriptKD.1232” infection

The Trojan.ScriptKD.1232 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.ScriptKD.1232 virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• Unconventionial language used in binary resources: Russian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Deletes executed files from disk
• Attempts to interact with an Alternate Data Stream (ADS)

How to determine Trojan.ScriptKD.1232?

File Info:
name: 6CAFA51833C78B28625A.mlw
path: /opt/CAPEv2/storage/binaries/7400c4228c54335184d87dd897e38515d30cfa67afb9e01e2819bd0481ca258d
crc32: 240E46D3
md5: 6cafa51833c78b28625a630c37f5c644
sha1: 624796c4019e7e153f731bf694382f98517a3b94
sha256: 7400c4228c54335184d87dd897e38515d30cfa67afb9e01e2819bd0481ca258d
sha512: 44113e97943685502af8edb1dbca59d4365ffae8f839e30fd24fa1cb047bb8b8d83ccf42a72cfcf2ac3b4b8a64d4680dd512404da5cc9f567abb8a7048f57c35
ssdeep: 24576:mnJBkPyZvjxUagj65rNyba9BnblYNe4fvau:mJBhZbCav5rNVbk7Ku
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T137050107B9C982BAE01912F0A3BD97939F76FF011935931213197A2ABCB32DD6D4B15C
sha3_384: ff6e65ff5728c6fc990d8bdacfb21aaa0225a58d9a73a896cb0771c06835f0c946cd2dc236f8b23e2576b9fe78ab33eb
ep_bytes: e89b27000050e8a72201000000000090
timestamp: 2005-10-07 09:05:22

Version Info:
0: [No Data]

Trojan.ScriptKD.1232 also known as:

How to remove Trojan.ScriptKD.1232?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.