What is “Trojan:Win32/Xiaoba!A”?

The Trojan:Win32/Xiaoba!A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Xiaoba!A virus can do?

Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan:Win32/Xiaoba!A?


File Info:
name: 44F1BFDB1BE284D22B2D.mlw
path: /opt/CAPEv2/storage/binaries/0bcc6560f504cf035446eb7692c1f59a6c6d409eefecae21d640512fd73ef612
crc32: F7F8CF55
md5: 44f1bfdb1be284d22b2d55f8a51a2a12
sha1: 2368fbb933fde16bd51985ed380b23a3b0c9670a
sha256: 0bcc6560f504cf035446eb7692c1f59a6c6d409eefecae21d640512fd73ef612
sha512: 4a737c7efb73057a1de09bd44d53b353d2002a33b5fb4f3c4617c24a6533cccc1872c14fb807fd64c04845bf14a6352a5c6812381b8aead9b1dd15c4a2bd1db4
ssdeep: 12288:6c9iJafmm2VYK+UNo0RweQfoOcvQbFVLrNfm3HkLNMDbu+yr:yVm2VZQf1bLNm3HkxMDbBy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T148B46D03F7D1C0B3DA92067018794B3EAA76FA6927704EDB63986D5D5E727C0583A30B
sha3_384: 90c4aa9da9f16acf8932b525f3f39b7b1fb1c00688784941f275847289203be010ca3686092eaf6d349d1b92430d53ee
ep_bytes: 00000000000000000000000000000000
timestamp: 2008-06-12 07:09:26

Version Info:
0: [No Data]

Trojan:Win32/Xiaoba!A also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.47577202
FireEye	Trojan.GenericKD.47577202
ALYac	Trojan.GenericKD.47577202
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7GW	Trojan ( 0013bf781 )
K7AntiVirus	Trojan ( 0013bf781 )
Cyren	W32/Trojan.OFOG-4170
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.OCI
APEX	Malicious
ClamAV	Win.Trojan.Qhost-160
BitDefender	Trojan.GenericKD.47577202
Avast	Win32:Miner-AL [Trj]
Tencent	Win32.Trojan.Generic.Pezp
Ad-Aware	Trojan.GenericKD.47577202
Emsisoft	Trojan.GenericKD.47577202 (B)
DrWeb	JS.Miner.11
TrendMicro	TROJ_GEN.R002C0DL621
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Lineage
GData	Trojan.GenericKD.47577202
Jiangmin	Backdoor/PcClient.jbv
Antiy-AVL	Trojan/Generic.ASCommon.192
Microsoft	Trojan:Win32/Xiaoba.gen!A
McAfee	Artemis!44F1BFDB1BE2
MAX	malware (ai score=88)
Malwarebytes	Malware.AI.793849284
TrendMicro-HouseCall	TROJ_GEN.R002C0DL621
Rising	Trojan.Kryptik!1.B3E8 (CLASSIC)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_82%
Fortinet	W32/Agent.OCI!worm
AVG	Win32:Miner-AL [Trj]
Panda	Trj/CI.A
MaxSecure	Trojan.Malware.121218.susgen

How to remove Trojan:Win32/Xiaoba!A?

Trojan:Win32/Xiaoba!A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X