Trojan.Win32.Shelma.bmit (file analysis)

The Trojan.Win32.Shelma.bmit is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Shelma.bmit virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Unconventionial language used in binary resources: Hebrew

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan.Win32.Shelma.bmit?


File Info:
crc32: 10308CA3
md5: a45b8108b502953749b5912ede858637
name: A45B8108B502953749B5912EDE858637.mlw
sha1: 656a2c65ab0261e3e63774bce198238e9eb31340
sha256: 8790715c086c346bd0154fad3c286cc698704f301372ab78ec9a7d14843d4458
sha512: f1bd3f291a84bf57d0bc0ce25215dde7b9b6faaabc1afd8c6b3fd8a4d99111f9710abb44667fb586f083ed3b9206936835e3f8628e1c8fe0c55e7b4ceb0feb6f
ssdeep: 1536:oCvsdtnXKEkBXXkAezxToSgpAGz1lSk482h+NiCt7J9guQNEt:ozaE8Xk9zFoSgKSek43ciCt7J9guQ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2017 Nir Sofer
InternalName: TimeZonesView
FileVersion: 1.06
CompanyName: NirSoft
ProductName: TimeZonesView
ProductVersion: 1.06
FileDescription: TimeZonesView
OriginalFilename: TimeZonesView.exe
Translation: 0x0409 0x04b0

Trojan.Win32.Shelma.bmit also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 00538a561 )
Lionic	Trojan.Win32.Shelma.4!c
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.46737147
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	Trojan:Win32/Shelma.78e7e5aa
K7GW	Trojan ( 00538a561 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Patched.IX
APEX	Malicious
Avast	FileRepMalware
Kaspersky	Trojan.Win32.Shelma.bmit
BitDefender	Trojan.GenericKD.46737147
MicroWorld-eScan	Trojan.GenericKD.46737147
Ad-Aware	Trojan.GenericKD.46737147
Sophos	Mal/Generic-S
TrendMicro	TROJ_GEN.R002C0WH721
McAfee-GW-Edition	BehavesLike.Win32.BadFile.ct
FireEye	Trojan.GenericKD.46737147
Emsisoft	Trojan.GenericKD.46737147 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Backdoor.Generic.bwzo
Microsoft	Trojan:Win32/Swrort.A
GData	Trojan.GenericKD.46737147
AhnLab-V3	Trojan/Win.Generic.C4584129
McAfee	Artemis!A45B8108B502
MAX	malware (ai score=87)
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0WH721
Rising	Trojan.Generic@ML.82 (RDML:rPEAWHh9jkwx7x0t9rAOUg)
Ikarus	Trojan.Win32.Patched
Fortinet	W32/Patched.IX!tr
AVG	FileRepMalware
Qihoo-360	Win32/Ransom.DogHousePower.HgIASZ4A

How to remove Trojan.Win32.Shelma.bmit?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.Win32.Shelma.bmit (file analysis)