Categories: Trojan

What is “UDS:Trojan.Win32.DelShad”?

The UDS:Trojan.Win32.DelShad is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What UDS:Trojan.Win32.DelShad virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Detects Sandboxie through the presence of a library
Checks for the presence of known windows from debuggers and forensic tools
Tries to unhook or modify Windows functions monitored by Cuckoo
Network activity detected but not expressed in API logs
Checks the version of Bios, possibly for anti-virtualization
Detects VirtualBox through the presence of a registry key
Anomalous binary characteristics

How to determine UDS:Trojan.Win32.DelShad?


File Info:
crc32: 242FB45Dmd5: ade3190a07961d1747b0d23249ff42c5name: ADE3190A07961D1747B0D23249FF42C5.mlwsha1: 539c8be110e81cf3d35e707ab9ef1d47f41de0c1sha256: 8780cf400cb69b62e89f00687f092a77d568569000f1b88e4ccb1fdcc58e8457sha512: 549c5597e37cb3a5578b58f97de42ee70296b2f3d5c75229bc6ca947340b2d27a73b636e8370d6a67ceaf70e9b772396ccc0c6d0a7759410ac87315c27b49711ssdeep: 49152:hPFqn5RlhTxxAIL1LavdFTrJNCp7xHZ5WqoW8otib6FxGHM82ITfe1OwYJ:9FiX1LxAdFTsvVobPW2M1ceowYJtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
Translation: 0x0000 0x04b0LegalCopyright: Copyright xa9  2021Assembly Version: 1.0.0.0InternalName: LegionLocker2.1.exeFileVersion: 1.0.0.0CompanyName: LegalTrademarks: Comments: ProductName: LegionLocker2.1ProductVersion: 1.0.0.0FileDescription: LegionLocker2.1OriginalFilename: LegionLocker2.1.exe

UDS:Trojan.Win32.DelShad also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Cybereason	malicious.110e81
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMetagen [Malware]
Kaspersky	UDS:Trojan.Win32.DelShad
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Sophos	ML/PE-A
F-Secure	Heuristic.HEUR/AGEN.1135447
BitDefenderTheta	Gen:NN.ZexaF.34686.dF0@ayh864bi
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
FireEye	Generic.mg.ade3190a07961d17
SentinelOne	Static AI – Suspicious PE
Webroot	W32.Ransom.Legion
Avira	HEUR/AGEN.1135447
eGambit	Unsafe.AI_Score_99%
Kingsoft	Win32.Heur.KVMH008.a.(kcloud)
Microsoft	Backdoor:Win32/Bladabindi!ml
Gridinsoft	Trojan.Heur!.032100A1
AegisLab	Trojan.Win32.Malicious.4!c
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Acronis	suspicious
McAfee	Artemis!ADE3190A0796
Panda	Trj/Genetic.gen
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazoao6/jcHkdDPrCAGRVfnd4)
Fortinet	W32/Themida.9A83!tr
AVG	FileRepMetagen [Malware]
Paloalto	generic.ml