Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Malware
Threat report

About “W32/Xolxo-B” infection

Published Nov 27, 2023 Malware category 3 min read
Report context

What to verify before removal

This report keeps About “W32/Xolxo-B” infection in the active library because the detection has enough technical context to support a careful second-opinion scan and cleanup decision.

Start by comparing the local file name with 96771BDE1936460E3DFC.mlw, then review the behavior notes for persistence entries, dropped files, unusual processes, and browser or network changes. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
96771BDE1936460E3DFC.mlw
  • Compare the suspicious file name with 96771BDE1936460E3DFC.mlw.
  • Confirm the detection name matches About “W32/Xolxo-B” infection before removing related files.
  • Review the report for persistence entries, dropped files, unusual processes, and browser or network changes so the cleanup is based on observed behavior, not only the label.
  • Run a full scan, quarantine confirmed detections, and restart before signing back in to sensitive accounts.

The W32/Xolxo-B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What W32/Xolxo-B virus can do?

  • Sample contains Overlay data
  • Reads data out of its own binary image
  • The binary contains an unknown PE section name indicative of packing
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine W32/Xolxo-B?



File Info:

name: 96771BDE1936460E3DFC.mlw
path: /opt/CAPEv2/storage/binaries/f78ef0216baaa2b897e9c59a103284d1b202db6c6834eb4d107ef2526d1f3f18
crc32: 254FD29A
md5: 96771bde1936460e3dfc1ec82f52f6b1
sha1: 8fefde622c3af5de32a28386af7a7b63a970b1b9
sha256: f78ef0216baaa2b897e9c59a103284d1b202db6c6834eb4d107ef2526d1f3f18
sha512: cbd6452b597a121b2e1c45528acaf40b1b322f1cd9159d84fe198dc415f2ca27e8ab7d1a940d1e335adeec46e2801843bcca3c117426687a3642774746736564
ssdeep: 98304:QzaCRVkK3WQtZ/K0tGOFWVRuLftCTwFhHZhcV2Vp:QzHkK3WyZ/K0ttYVAAT+hcV2Vp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B9865A1BF6D900E9D07AD1B4CE214721E6B2BC5A8BB155DF225462CD1E3BEE47B38720
sha3_384: 227d475b8ee6ce7674ff24cfc3c37759e242b9a9d537fab46f8d6e6e0288fb4d4c51fdf8b759ae1ffa45fd83a2fb8f68
ep_bytes: 558bec83c4f0b838464000e874e2ffff
timestamp: 1992-06-19 22:22:17


Version Info:

0: [No Data]

W32/Xolxo-B also known as:

Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.79273
FireEye Generic.mg.96771bde1936460e
CAT-QuickHeal Worm.DelfPMF.S30896276
Skyhigh BehavesLike.Win32.Generic.rh
ALYac Trojan.GenericKDZ.79273
Malwarebytes Generic.Trojan.Delf.DDS
Zillya Worm.Delf.Win32.3450
Sangfor Suspicious.Win32.Save.ins
K7AntiVirus Trojan ( 0053c5661 )
K7GW Trojan ( 0053c5661 )
Cybereason malicious.22c3af
Baidu Win32.Virus.Lamer.f
Symantec W32.SillyP2P
tehtris Generic.Malware
ESET-NOD32 Win32/Delf.NAY
Cynet Malicious (score: 100)
APEX Malicious
ClamAV Win.Ransomware.Ulise-9978047-0
Kaspersky P2P-Worm.Win32.Delf.aj
BitDefender Trojan.GenericKDZ.79273
NANO-Antivirus Trojan.Win32.Delf.oxkq
Avast Win32:Delf-SVI [Trj]
Tencent Virus.Win32.Lamer.fh
Emsisoft Trojan.GenericKDZ.79273 (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb Win32.HLLW.Kazaa.924
VIPRE Trojan.GenericKDZ.79273
TrendMicro TROJ_AGENT_005911.TOMB
Trapmine malicious.high.ml.score
Sophos W32/Xolxo-B
Ikarus Worm.Win32.Eggnog
Jiangmin Worm/Delf.vm
Webroot W32.Worm.Gen
Varist W32/Delf.QB.gen!Eldorado
Avira TR/Dropper.Gen
Antiy-AVL Virus/Win32.BagarBubba.a
Xcitium TrojWare.Win32.Pincav.AV@2rw0ny
Arcabit Trojan.Generic.D135A9
ZoneAlarm P2P-Worm.Win32.Delf.aj
GData Trojan.GenericKDZ.79273
Google Detected
AhnLab-V3 Worm/Win32.Delf.R119214
Acronis suspicious
McAfee W32/HLLP.11042.gen
MAX malware (ai score=82)
VBA32 Worm.Delf
Cylance unsafe
Panda Trj/Genetic.gen
TrendMicro-HouseCall TROJ_AGENT_005911.TOMB
Rising Worm.P2p.Win32.Delf.bn (CLASSIC)
Yandex Trojan.GenAsa!HYSjiRN/8Mk
SentinelOne Static AI – Malicious PE
MaxSecure Virus.W32.Lamer.FG
Fortinet W32/Aple.A
BitDefenderTheta Gen:NN.ZelphiF.36792.@pZ@auciUnn
AVG Win32:Delf-SVI [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)

How to remove W32/Xolxo-B?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.