Malware

Win32/ShellcodeRunner.W removal tips

Malware Removal

The Win32/ShellcodeRunner.W is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/ShellcodeRunner.W virus can do?

  • Dynamic (imported) function loading detected
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Authenticode signature is invalid

How to determine Win32/ShellcodeRunner.W?



File Info:

name: C0C5462FE59BCF302078.mlw
path: /opt/CAPEv2/storage/binaries/0dae37b0d59647b7ec40e6983fa9f9d2cca59ea77b1aee77fb8ed5451d27c1b3
crc32: 6585CA3F
md5: c0c5462fe59bcf302078bd1f29e53290
sha1: 1552bf799f379d0c0c5e485f30766824a7f5418c
sha256: 0dae37b0d59647b7ec40e6983fa9f9d2cca59ea77b1aee77fb8ed5451d27c1b3
sha512: 31a5bb3a4703c461ab9a4b50a4adad4ce9521450957a6868c831d9185c7f3f0430c1b15e31dc6e6a8dbf7657e3f0ae5eba1ed224a7c9dd0826d353b6f0142e99
ssdeep: 3072:KrtrdY3fJcDRIGDf8fjfnfnfnfzfbfbfbfYf/f/f/frfffLfffLfffLfffaffffu:K7Y3fqDRIGoS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T143B3C71161425576E23F4A724EBFA829514CFEA20F0069F373887DAD95BF4E23D6211F
sha3_384: bc876da98d5659a0639b6ddf227f35dbf80414c182d6efa7c1d636441389789659d896a97d8b7bf1a7afde25daf5e2db
ep_bytes: 558bec6aff685032410068c001410064
timestamp: 2022-07-11 07:02:53


Version Info:

Comments: 
CompanyName: 5b6t5etvetbetv
FileDescription: 5b6t5etvetbetv
FileVersion: 1, 0, 0, 1
InternalName: 5b6t5etvetbetv
LegalCopyright: 版权所有(C) 2021
LegalTrademarks: 
OriginalFilename: 5b6t5etvetbetv
PrivateBuild: 
ProductName: 5b6t5etvetbetv
ProductVersion: 1, 0, 0, 1
SpecialBuild: 
Translation: 0x0804 0x04b0

Win32/ShellcodeRunner.W also known as:

LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.49410944
CAT-QuickHealTrojan.Agent
McAfeeRDN/Generic.dx
CylanceUnsafe
SangforTrojan.Win32.Shellcoderunner.Vwl0
CrowdStrikewin/malicious_confidence_60% (W)
AlibabaTrojan:Win32/ShellcodeRunner.fcae025f
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/ShellcodeRunner.W
APEXMalicious
Paloaltogeneric.ml
BitDefenderTrojan.GenericKD.49410944
Ad-AwareTrojan.GenericKD.49410944
EmsisoftTrojan.GenericKD.49410944 (B)
VIPRETrojan.GenericKD.49410944
TrendMicroTROJ_GEN.R002C0PGO22
McAfee-GW-EditionRDN/Generic.dx
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.c0c5462fe59bcf30
IkarusTrojan.Win32.Shellcoderunner
GDataTrojan.GenericKD.49410944
AviraTR/ShellRunner.eipdm
Antiy-AVLTrojan/Generic.ASMalwS.6BF7
ArcabitTrojan.Generic.D2F1F380
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 99)
VBA32BScope.Trojan.Downloader
ALYacTrojan.GenericKD.49410944
MAXmalware (ai score=81)
PandaTrj/Chgt.AD
TrendMicro-HouseCallTROJ_GEN.R002C0PGO22
RisingTrojan.ShellcodeRunner!8.6166 (CLOUD)
MaxSecureTrojan.Malware.186099930.susgen
FortinetW32/PossibleThreat
BitDefenderThetaGen:NN.ZexaCO.34806.gq0@aGkB@Ahb
AVGWin32:Evo-gen [Susp]
AvastWin32:Evo-gen [Susp]

How to remove Win32/ShellcodeRunner.W?

Win32/ShellcodeRunner.W removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment