About “Trojan:Win32/Xiaoba!pz” infection

The Trojan:Win32/Xiaoba!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Xiaoba!pz virus can do?

• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Creates an autorun.inf file
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Creates a copy of itself
• Attempts to disable or modify Explorer Folder Options
• Attempts to disable UAC
• Touches a file containing cookies, possibly for information gathering
• The sample wrote data to the system hosts file.
• Attempts to block SafeBoot use by removing registry keys
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Xiaoba!pz?

File Info:
name: C7D6F737545E535CDC0E.mlw
path: /opt/CAPEv2/storage/binaries/374391d0c46eb5e70ae5248f777c2f9f80b90dac0fbafbeece3423266e1e2806
crc32: 2316165F
md5: c7d6f737545e535cdc0ec96dd7b9449f
sha1: 5642da4661b3a09277300131870bdc0f9f68fad1
sha256: 374391d0c46eb5e70ae5248f777c2f9f80b90dac0fbafbeece3423266e1e2806
sha512: 43264a4770a5b38d84d87cf98cb766a79897223a62d6950c9b14a8a96d367732742ddaa4263b6577cbf19c38a8a372c3ba57543829f33c3d82104e93d7fbaa28
ssdeep: 49152:gwnzcErdabk+YpYqcpYqrgjI45TMwwapIgTI:d6Z6aLapI9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T110E52922B1A14565C0AAC075CF929625DBF13C698FF083EB714DB2D82F736D0763A71A
sha3_384: a5b58280abc460caffc6969bb9bcbcd12fa7d871b142f11235d821947afa58dd3d05ba03e98ff4597799ad89668d6747
ep_bytes: 60be00c043008dbe0050fcff5783cdff
timestamp: 2018-01-10 12:57:18

Version Info:
FileVersion: 3, 2, 2, 2075
ProductVersion: 3, 2, 2, 2075
CompanyName: 360.cn
FileDescription: 360主动防御服务模块
InternalName: ZhuDongFangYu
LegalCopyright: (C)360.cn All Rights Reserved.
OriginalFilename: ZhuDongFangYu.exe
ProductName: 360安全卫士
Translation: 0x0804 0x04b0

Trojan:Win32/Xiaoba!pz also known as:

How to remove Trojan:Win32/Xiaoba!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.