About “Trojan:Win32/Taloc.D” infection

The Trojan:Win32/Taloc.D is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Taloc.D virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Possible date expiration check, exits too soon after checking local time
• Checks adapter addresses which can be used to detect virtual network interfaces
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Drops a binary and executes it
• Authenticode signature is invalid
• Network activity contains more than one unique useragent.
• Installs itself for autorun at Windows startup
• Attempts to identify installed AV products by registry key
• Attempts to modify proxy settings
• Creates a copy of itself
• The sample wrote data to the system hosts file.

How to determine Trojan:Win32/Taloc.D?

File Info:
name: 86D14A217DC308A25DC6.mlw
path: /opt/CAPEv2/storage/binaries/ccceb27554d7262f83e7bfbfb4ef79e1177d06cddeb8ce7c4a8de60fe963eeac
crc32: 9F898223
md5: 86d14a217dc308a25dc61d58171c6191
sha1: 09e3ad81adb29b5d3a77cbe7d08c24e493e09a95
sha256: ccceb27554d7262f83e7bfbfb4ef79e1177d06cddeb8ce7c4a8de60fe963eeac
sha512: 43ace312fcccda2050637f6da25484ea75d33629f3ac19beb45d2dcadae2e48e0c2c7a40c0fbcb3b59df065583c07c98a1aca7edc3dbc508b75f842a0638e7ce
ssdeep: 1536:ziQf3pIfar2XJ2hRGSHXOiYJwfjq8+acPfaGdRtNIGRZ:zioIfaCQ3nYafp+7aGdjNIc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13BB30813A61084FEE439537245F70738EE70D76528B18A67EBA4CDB22D722348F57A8D
sha3_384: b6f3c417e9720b0519e39d25d4941d190f011561ac7fad6fcce24d1e96134077aac54381adb7a45313f29a911b9a8280
ep_bytes: e89bcc0000e8b8c9000033c0c3909090
timestamp: 2014-09-25 11:15:38

Version Info:
0: [No Data]

Trojan:Win32/Taloc.D also known as:

How to remove Trojan:Win32/Taloc.D?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.