Categories: Trojan

What is “Trojan.Win32.ShipUp.boo”?

The Trojan.Win32.ShipUp.boo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.ShipUp.boo virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Behavioural detection: Transacted Hollowing
Collects information to fingerprint the system
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan.Win32.ShipUp.boo?


File Info:
name: 75323D08D5283E9D22E3.mlwpath: /opt/CAPEv2/storage/binaries/2c39c8611a8cde2fc486d2fdaf5babdfb9c79635c4f8e117b0be692cd580361fcrc32: 735583EBmd5: 75323d08d5283e9d22e3607bffb2a27bsha1: f5315c1e00b58e412d26eb1ed1e305e50ba07dabsha256: 2c39c8611a8cde2fc486d2fdaf5babdfb9c79635c4f8e117b0be692cd580361fsha512: 50cf08eeec44098f81a954bc72253c44023fa2d4cd88ef565ade7b011e6b4ad35e5b76ddd3740dd97941c21a6e90ff891f751dedea70d7488394c8bd76afd6efssdeep: 3072:Y969UjrL5vSfmA1m6FtMeYxo4XkaS0Fa2jhjiOC5prhYPTDlnS:YUUTxSfm76FsXkyN1iOYhElStype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F5348BF08180647AD89882F05C52AD3A4E1DFC264B946DEB1259F9D63FB32C497EE41Fsha3_384: ac7fed145825ddb6f8dceb971e44f3a7732a59e8b6df40450940b639901058398890adade3f544237962f4817a8f663eep_bytes: 558bec5155c745fc3bdb0000c745fc3btimestamp: 2013-03-22 18:17:14
Version Info:
CompanyName: Microsoft CorporationFileDescription: Microsoft DirectPlay Voice TestFileVersion: 5.03.2600.5512 (xpsp.080413-0845)InternalName: dpvsetup.exeLegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: dpvsetup.exeProductName: Microsoft® Windows® Operating SystemProductVersion: 5.03.2600.5512Translation: 0x0409 0x04b0

Trojan.Win32.ShipUp.boo also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.95588
FireEye	Generic.mg.75323d08d5283e9d
CAT-QuickHeal	TrojanDropper.Gepys.A
McAfee	Packed-AM!75323D08D528
Cylance	unsafe
Zillya	Trojan.ShipUp.Win32.1237
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Baidu	Win32.Trojan.Agent.eq
VirIT	Trojan.Win32.Generic.QGQ
Cyren	W32/Zbot.JC.gen!Eldorado
Symantec	Packed.Generic.459
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.AXID
APEX	Malicious
ClamAV	Win.Trojan.Shipup-4
Kaspersky	Trojan.Win32.ShipUp.boo
BitDefender	Trojan.GenericKDZ.95588
NANO-Antivirus	Trojan.Win32.ShipUp.bqolrw
SUPERAntiSpyware	Trojan.Agent/Gen-Crypt
Avast	Win32:Gepys-J [Trj]
Rising	Trojan.Kryptik!1.AB8B (CLASSIC)
Emsisoft	Trojan.GenericKDZ.95588 (B)
F-Secure	Trojan.TR/Crypt.ZPACK.Gen8
DrWeb	Trojan.Siggen5.1870
VIPRE	Trojan.GenericKDZ.95588
TrendMicro	TROJ_KRYPTK.SML3
McAfee-GW-Edition	BehavesLike.Win32.Sality.dh
Trapmine	malicious.high.ml.score
Sophos	Mal/EncPk-AIT
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE.1KR2NFM
Jiangmin	Trojan/ShipUp.aai
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/Crypt.ZPACK.Gen8
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Win32.ShipUp
Kingsoft	malware.kb.a.1000
Xcitium	TrojWare.Win32.Kryptik.AYQE@4wlbfl
Arcabit	Trojan.Generic.D17564
ZoneAlarm	Trojan.Win32.ShipUp.boo
Microsoft	Trojan:Win32/Vindor!pz
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Shipup.R58811
VBA32	BScope.Malware-Cryptor.Hlux
ALYac	Trojan.GenericKDZ.95588
TACHYON	Trojan/W32.Shipup.249520
Malwarebytes	Crypt.Trojan.Malicious.DDS
Panda	Trj/Hexas.HEU
TrendMicro-HouseCall	TROJ_KRYPTK.SML3
Tencent	Trojan.Win32.Shipup.yaw
Yandex	Trojan.GenAsa!inOEU/QgBGA
Ikarus	Trojan.Win32.ShipUp
MaxSecure	Trojan.Malware.5473449.susgen
Fortinet	W32/Kryptik.AYUW!tr
BitDefenderTheta	Gen:NN.ZexaF.36738.py1@aqj@O!ji
AVG	Win32:Gepys-J [Trj]
Cybereason	malicious.e00b58
DeepInstinct	MALICIOUS