Trojan

How to remove “Trojan.Win32.Qshell.jef”?

Malware Removal

The Trojan.Win32.Qshell.jef is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan.Win32.Qshell.jef virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Possible date expiration check, exits too soon after checking local time
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (21 unique times)
  • A named pipe was used for inter-process communication
  • Starts servers listening on 0.0.0.0:0
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Looks up the external IP address
  • Executed a very long command line or script command which may be indicative of chained commands or obfuscation
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Executed a process and injected code into it, probably while unpacking
  • Detects Sandboxie through the presence of a library
  • Detects Avast Antivirus through the presence of a library
  • Checks for the presence of known windows from debuggers and forensic tools
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Checks the version of Bios, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Detects VMware through the presence of a registry key
  • Attempts to modify proxy settings
  • Attempts to disable Windows Defender
  • Attempts to create or modify system certificates
  • Collects information to fingerprint the system
  • Uses suspicious command line tools or Windows utilities

Related domains:

hsiens.xyz
a.goatgame.co
cdn.discordapp.com
safialinks.com
ocsp.digicert.com
ipinfo.io
i.spesgrt.com
aa.goatgamea.com
eurekabike.com
privacytoolz123foryou.xyz
2551889d-a2db-4908-a9a2-6b0fab0a7a78.s3.eu-west-2.amazonaws.com
manager4youdrivers.ru
apps.identrust.com
telegram.org
twitter.com
yandex.ru
cleaner-partners.biz
crl.identrust.com
romkaxarit.tumblr.com
lenko349.tumblr.com
iplis.ru
ocsp.comodoca.com
crl.comodoca.com
ocsp.usertrust.com
crl.usertrust.com
ocsp.sectigo.com
iplogger.org
s2.symcb.com
proxycheck.io
connectini.net

How to determine Trojan.Win32.Qshell.jef?


File Info:

crc32: 14CA2C50
md5: a65b1b0c7c35efbf0ad82691841c7f05
name: A65B1B0C7C35EFBF0AD82691841C7F05.mlw
sha1: c82d92894c0709eb319b19f8a0d4d8797241f384
sha256: ecc23ade7514bff1e172b9a02c27572a66e0d16bb68b4927198dc091abf1c982
sha512: 7e3aa8e9e369fa4132cd74051e854350b8eeb591e8e13abba4cb40dd076e900a4af6d602febcf7187a0f48661b9ce8946a1c55396a7ecf8ca795d07c9dfbe595
ssdeep: 98304:xmCvLUBsg6AK6cCcJFe+qDP1WxYwnLNV8A5e6GoHW3lGRxPLk+1NlQg3:xPLUCg6AK6cE23sm1HWoRq+13Qe
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (c) 1999-2018 Igor Pavlov
InternalName: 7zS.sfx
FileVersion: 19.00
CompanyName: Igor Pavlov
ProductName: 7-Zip
ProductVersion: 19.00
FileDescription: 7z Setup SFX
OriginalFilename: 7zS.sfx.exe
Translation: 0x0409 0x04b0

Trojan.Win32.Qshell.jef also known as:

K7AntiVirusRiskware ( 0040eff71 )
LionicTrojan.Win32.Qshell.4!c
Elasticmalicious (high confidence)
DrWebTrojan.DownLoader41.63105
CynetMalicious (score: 100)
CAT-QuickHealTrojan.SabsikIH.S21959152
ALYacGen:Variant.Jaik.45703
CylanceUnsafe
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojanDownloader:Win32/Zenlod.bdb15f9c
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.c7c35e
CyrenW32/Kryptik.EYC.gen!Eldorado
ESET-NOD32multiple detections
AvastWin32:CrypterX-gen [Trj]
ClamAVWin.Packed.Barys-9859531-0
KasperskyTrojan.Win32.Qshell.jef
BitDefenderGen:Variant.Jaik.45703
NANO-AntivirusTrojan.Win32.PackedNET.izbtnw
MicroWorld-eScanGen:Variant.Jaik.45703
TencentWin32.Trojan.Multiple.Llqx
Ad-AwareGen:Variant.Jaik.45703
SophosMal/Generic-S
BitDefenderThetaGen:NN.ZedlaF.34126.n88baOE@FOp
TrendMicroTROJ_GEN.R049C0PH821
McAfee-GW-EditionBehavesLike.Win32.AdwareBitLocker.rc
FireEyeGen:Variant.Jaik.45703
EmsisoftGen:Variant.Jaik.45703 (B)
JiangminTrojanSpy.MSIL.bqww
AviraEXP/YAV.Minerva.thltc
eGambitUnsafe.AI_Score_91%
Antiy-AVLTrojan/Generic.ASMalwS.3489A2F
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftTrojan:Win32/ArkeiStealer.DB!MTB
ArcabitTrojan.Jaik.DB287
ZoneAlarmTrojan-Downloader.Win32.Zenlod.lgi
GDataGen:Variant.Jaik.45703
McAfeeArtemis!A65B1B0C7C35
MAXmalware (ai score=81)
VBA32Trojan.Racoon
MalwarebytesTrojan.Dropper.SFX.Generic
TrendMicro-HouseCallTROJ_GEN.R049C0PH821
RisingTrojan.Kryptik!1.D91D (CLASSIC)
FortinetW32/BSE.4Q7Q!tr
AVGWin32:CrypterX-gen [Trj]
Paloaltogeneric.ml

How to remove Trojan.Win32.Qshell.jef?

Trojan.Win32.Qshell.jef removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment