Trojan.Win32.Khalesi.lqgz removal tips

The Trojan.Win32.Khalesi.lqgz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Khalesi.lqgz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Installs itself for autorun at Windows startup
• Uses suspicious command line tools or Windows utilities

Related domains:

How to determine Trojan.Win32.Khalesi.lqgz?

File Info:
name: 1D98E40383812473045B.mlw
path: /opt/CAPEv2/storage/binaries/1762b38f6aeeaa2c28b3024887a34f9e5a1723ef66a4800dc8412a6403305fba
crc32: BA184584
md5: 1d98e40383812473045b38ba13db57a2
sha1: d7d269c5ffc17630021b73558721a94e8ec7237c
sha256: 1762b38f6aeeaa2c28b3024887a34f9e5a1723ef66a4800dc8412a6403305fba
sha512: 4b21860a0866bd1b5367c2619ef63ce5b844181b6bf34f785f94d5ae63ce4530527e2e116685de44fe88c29b94e1a95e63fe148846ed0c28cfe951231b27911d
ssdeep: 6144:i8TxMV4HLmEquz+JAEtEQO6Ah/H1+ADIRs7QHiVUxgebv9LKetllXOCKklUgz7r:i5Lt9DA5dDgFxgebv9W8lznz7r
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E6B4E1F805568A35C81457F82E961B792A9EEDD4425B2AEECD0C18663FC7737A2C3C70
sha3_384: ec271c72f9a4c5d20d7c7dcbb6db54e33839dae30cd309b9537e18ad3c5985a5e16eacb2f2e8340b1440d275246d6bae
ep_bytes: ba000000005689c047405921c721c783
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan.Win32.Khalesi.lqgz also known as:

How to remove Trojan.Win32.Khalesi.lqgz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.