What is “Trojan.Win32.Khalesi.lrff”?

The Trojan.Win32.Khalesi.lrff is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Khalesi.lrff virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• NtSetInformationThread: attempt to hide thread from debugger
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Expresses interest in specific running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Behavioural detection: Transacted Hollowing
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Uses suspicious command line tools or Windows utilities

How to determine Trojan.Win32.Khalesi.lrff?

File Info:
name: 6857C9918568D97D2EDC.mlw
path: /opt/CAPEv2/storage/binaries/40beb9095d76014ac6dc5c46339b1c05072f2d2580b8e6739e6d40b980ecb3f7
crc32: A77DCA00
md5: 6857c9918568d97d2edcbb6daaf91fe6
sha1: cfa587cefd139514f0ec38dcc7a34a386d2a68b4
sha256: 40beb9095d76014ac6dc5c46339b1c05072f2d2580b8e6739e6d40b980ecb3f7
sha512: 9b54463d27b0cd0feb3210d8f67defbec570cf7e0e2d882343a2cf51fb336a0b0216f09ee9b7dfc11209c4e7c007e9306e579375ada6a6c7ec894bbd076d98d9
ssdeep: 49152:FtO1ikKq+GMQBaTYipCjG+4dEA+GMQBaTYipCjK:F/kVa2G+ma2K
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E9A512F454F37A6AF5700938D2DE5E835ACE80E4A5F3784AA2C59AADF5153B00E8CF41
sha3_384: 321e3b41b4dc3ed18853d04412fb010bdc9999a8ce8201fa39d26e1d9efc6284a0c762f011336175c3563259adf5fb96
ep_bytes: 68000000005a5181ef80701c2f01f74e
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

Trojan.Win32.Khalesi.lrff also known as:

How to remove Trojan.Win32.Khalesi.lrff?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.