Win32:RansomShade-B [Trj] information

The Win32:RansomShade-B [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:RansomShade-B [Trj] virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32:RansomShade-B [Trj]?


File Info:
name: CF9AE8B9810555EE6E05.mlw
path: /opt/CAPEv2/storage/binaries/f1d75898acf2534d272c5b701bc07f8e5830b42770e96e692a273c4455361638
crc32: 84EC9188
md5: cf9ae8b9810555ee6e0588af114f37ea
sha1: 77a945a9e7eab74ba134b0312e1f76b0d688e037
sha256: f1d75898acf2534d272c5b701bc07f8e5830b42770e96e692a273c4455361638
sha512: 2d433a4a4878e47f517c3e4b780b15262f70bf42eff1c51ab8f7c400f689ddef27190520201c3fb15950bd34922c99e1467364749d9bba88a915ac89756c3bfe
ssdeep: 3072:IC4bt+ykFbXX/tt5gZpwQd3nZkbo1wsJWICdtnZNXU:6h+ykFDX/tt5ipwQd3Zks1NqZNk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13A04E01AE4C3BC58D07D863247A3C2874B2D6C6D819BCB8F61498E2D34572F66734BB9
sha3_384: b90e12aa54043e0c5ca66114e620d1d756f1ced018596451621036b3ae44415635515c2b5f019e6aa5e822213584337e
ep_bytes: 558bec6aff6868324000680220400064
timestamp: 2015-07-07 18:51:37

Version Info:
0: [No Data]

Win32:RansomShade-B [Trj] also known as:

MicroWorld-eScan	Gen:Variant.Zbot.176
FireEye	Generic.mg.cf9ae8b9810555ee
McAfee	PWSZbot-FAKV!CF9AE8B98105
Zillya	Trojan.Zbot.Win32.183870
K7AntiVirus	Trojan ( 0055e3991 )
K7GW	Trojan ( 0055e3991 )
Cybereason	malicious.981055
Cyren	W32/S-3650669b!Eldorado
Symantec	SMG.Heur!gen
ESET-NOD32	Win32/Kovter.D
ClamAV	Win.Trojan.AppWizard-9763600-1
Kaspersky	Trojan-Ransom.Win32.Shade.ug
BitDefender	Gen:Variant.Zbot.176
NANO-Antivirus	Trojan.Win32.Encoder.duagzv
APEX	Malicious
Tencent	Malware.Win32.Gencirc.10b3eab8
Sophos	ML/PE-A + Mal/Zbot-UE
Comodo	TrojWare.Win32.Bagsu.AF@5szj4v
DrWeb	Trojan.Encoder.858
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Emsisoft	Gen:Variant.Zbot.176 (B)
Jiangmin	Trojan/Shade.c
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Generic.ASMalwS.127A1E4
Microsoft	Trojan:Win32/DllCheck.A!MSR
ViRobot	Trojan.Win32.CTB-Locker.790528
ZoneAlarm	Trojan-Ransom.Win32.Shade.ug
GData	Win32.Trojan-Ransom.Troldesh.B
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Miuref.R159490
VBA32	TrojanDropper.Injector
ALYac	Gen:Variant.Zbot.176
Malwarebytes	Trojan.Kovter.ED
Avast	Win32:RansomShade-B [Trj]
Rising	Ransom.Shade!8.12CC (TFE:dGZlOgF1AHCRoUk77A)
Yandex	Trojan.GenAsa!qyTgXK+Aa+U
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Generic.AC.1F4264!tr
AVG	Win32:RansomShade-B [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Win32:RansomShade-B [Trj]?

Win32:RansomShade-B [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X