Trojan.Win32.Walerlop.boa malicious file

The Trojan.Win32.Walerlop.boa is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.Walerlop.boa virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Access the NetLogon registry key, potentially used for discovery or tampering
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• CAPE detected the IcedIDStage1 malware family
• Creates a copy of itself

How to determine Trojan.Win32.Walerlop.boa?

File Info:
name: B289C0FAEED47E75CE4C.mlw
path: /opt/CAPEv2/storage/binaries/e6f700bce5f1a4aabbbde4816b42464b16070c1624255b141739af8329c7d12e
crc32: 8D33BEC4
md5: b289c0faeed47e75ce4c9a2a37f32829
sha1: 60dfba982d63f701686edc39d747f53a3e5d716b
sha256: e6f700bce5f1a4aabbbde4816b42464b16070c1624255b141739af8329c7d12e
sha512: 009b76d1a9cdb9d6cc90ae63f859a8c842edade1a81430ea3892425f353338252def4070cfb1afc102beb2db5759d65f0231cbb1b606fde738fa57790c35ef01
ssdeep: 6144:K3YXSg0OA72g8zRQUDujtlSXFScPUF4S:K39g7A58uU0ARUN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E5745B0079D1D43EC4A2853F4895E5A62A29BD204B3194F7B7C85F4FEB7F2C06626B63
sha3_384: cd208e017e55c90268662f0f23fa2e6aa23fcfd4dae43d4ce9541ba008cbf5f9436781d16fe26ac694195dfa430f5a46
ep_bytes: e886940000e9000000006a1468809643
timestamp: 2015-02-25 12:09:27

Version Info:
FileDescription: Savetold
FileVersion: 6.7.78.87
LegalCopyright: Copyright (c) 2004-2015 SafeSoft Solutions
InternalName: Savetold
OriginalFilename: fourtold.exe
ProductName: Savetold
ProductVersion: 6.7.78.87
Translation: 0x0409 0x04b0

Trojan.Win32.Walerlop.boa also known as:

How to remove Trojan.Win32.Walerlop.boa?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.