TrojanSpy:Win32/Shiotob.A malicious file

The TrojanSpy:Win32/Shiotob.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanSpy:Win32/Shiotob.A virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid

How to determine TrojanSpy:Win32/Shiotob.A?

File Info:
name: EC89A41AC88CB62A0E56.mlw
path: /opt/CAPEv2/storage/binaries/283c2399e5203b318ba99fbdd9b82e6bd46e5cce4155bd693555ec70d5f6e92f
crc32: 6BD34361
md5: ec89a41ac88cb62a0e569fc058cc4d71
sha1: 1c9afa5aedb50a0da3fa57faaef3d4dd61b99da9
sha256: 283c2399e5203b318ba99fbdd9b82e6bd46e5cce4155bd693555ec70d5f6e92f
sha512: 3a369192ddf70e9eec38a2f383af4f174a63ad901ffe62b689e187f8a05955397217cf787a3f798e5c513c56b315db09e89f3b6acc7b69479dbb2bce481d72e4
ssdeep: 6144:UqK4AkGsBkL88iAQCuy5JmtNaxdWuaSbGqcSbGq9y:UFlwQQCVJmX4dsSKS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14A64DFB6766CCD20C4613DB58AD3EEA01A275D248E74BC4731607F7FEC37288992A46D
sha3_384: a71953eca830ca69b295a4437258b7ee3aaa7a15681750fdef635a799352ffed28f8785a671f8f39cf82b386daed0701
ep_bytes: 558bec518bcd8bc18945fc6827020000
timestamp: 2013-05-08 06:52:58

Version Info:
CompanyName: Hilgraeve, Inc.
FileDescription: HyperTerminal Applet
FileVersion: 5.1.2600.0
InternalName: HyperTrm
LegalCopyright: Copyright © Hilgraeve, Inc. 2001
dd: HyperTerminal ® is a registered trademark of Hilgraeve, Inc. 
Translation: 0x0409 0x0000

TrojanSpy:Win32/Shiotob.A also known as:

How to remove TrojanSpy:Win32/Shiotob.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.