Should I remove “Trojan:Win32/ShellcodeRunner.EK!MTB”?

The Trojan:Win32/ShellcodeRunner.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/ShellcodeRunner.EK!MTB virus can do?

Reads data out of its own binary image
Authenticode signature is invalid

How to determine Trojan:Win32/ShellcodeRunner.EK!MTB?


File Info:
name: 44AF91A4CE75651AE652.mlw
path: /opt/CAPEv2/storage/binaries/e1b829893877c1c155bbb6567d35c92cad5de0bfe0b662eb6d57c9c00845db5c
crc32: E1934936
md5: 44af91a4ce75651ae6527ae86ad8c6c5
sha1: b2d3689ab533f7f38435c75b499ac545d6ce814d
sha256: e1b829893877c1c155bbb6567d35c92cad5de0bfe0b662eb6d57c9c00845db5c
sha512: cc3c53da74a5b3e57365c8a7dc7780342a39eb4073fd05961e84f017d22dcdfbc4f3004129343a37af2e0f17ed29c4a8f154ec0cba975c8e62018b240717d42e
ssdeep: 1536:M9ER9ve+HW4A6yKr7ownTxgAJnPKwuUSoosWaocdBSheDQU+Go:GEe0zA6yKFdgC/RBSheDQU+3
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1B0836A01B5D1C079D9BE19350464CAB25B3EB920DED1DDAB279606BE4F302C1DE31E6B
sha3_384: 29cc9c91f071caaedfa0ce28968cb621722110f41db9e7e4351ce97a316a9cf852f857581a32c109aa7b23aa62b3f71a
ep_bytes: 558bec837d0c017505e884010000ff75
timestamp: 2024-03-14 07:53:59

Version Info:
0: [No Data]

Trojan:Win32/ShellcodeRunner.EK!MTB also known as:

MicroWorld-eScan	Gen:Variant.Doina.72418
CrowdStrike	win/malicious_confidence_90% (D)
BitDefenderTheta	Gen:NN.ZedlaF.36802.fu4@auhaW6fi
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ShellcodeRunner.JQ
APEX	Malicious
BitDefender	Gen:Variant.Doina.72418
Emsisoft	Gen:Variant.Doina.72418 (B)
VIPRE	Gen:Variant.Doina.72418
FireEye	Generic.mg.44af91a4ce75651a
SentinelOne	Static AI – Suspicious PE
MAX	malware (ai score=81)
Microsoft	Trojan:Win32/ShellcodeRunner.EK!MTB
Arcabit	Trojan.Doina.D11AE2
GData	Gen:Variant.Doina.72418
Cynet	Malicious (score: 100)
Rising	Trojan.Generic@AI.96 (RDML:GI4ZxvIcRwbZee/bDtMArQ)
Fortinet	W32/ShellcodeRunner.JQ!tr
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/ShellcodeRunner.EK!MTB?

Trojan:Win32/ShellcodeRunner.EK!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X