Trojan.GO.ShellcodeRunner
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 28 |
| First Seen: | February 29, 2024 |
| Last Seen: | March 11, 2026 |
| OS(es) Affected: | Windows |
Your system has been detected to be infected with the Trojan.GO.ShellcodeRunner threat. This detection indicates that your computer is likely compromised by a type of malicious software designed to execute arbitrary code, potentially leading to various security issues and vulnerabilities. It is essential to understand the nature of this threat and take immediate action to remove it and protect your system.
Table of Contents
What Is Trojan.GO.ShellcodeRunner?
Trojan.GO.ShellcodeRunner, as the name suggests, is associated with Trojan-type malware. Trojans are malicious programs that disguise themselves as legitimate software, allowing them to bypass security mechanisms and infiltrate computer systems. Once inside, they can perform a wide range of harmful activities, including data theft, espionage, and the installation of additional malware. The term "ShellcodeRunner" implies that this particular threat is designed to execute shellcode, which is a small piece of code used as the payload in the exploitation of a software vulnerability. Shellcode is typically used to create a backdoor, allowing an attacker to access the system remotely.
How Trojan.GO.ShellcodeRunner Operates
The operation of Trojan.GO.ShellcodeRunner, like many Trojans, involves exploiting vulnerabilities in software or tricking users into installing it. Once installed, it can operate in stealth mode, hiding from the user and security software. Its primary function is to execute shellcode, which can lead to the installation of other malware, the theft of sensitive information, or the use of the infected computer as part of a botnet for malicious activities such as DDoS attacks or spamming.
Symptoms of Infection
Symptoms of a Trojan.GO.ShellcodeRunner infection can vary widely depending on its payload and the intentions of its creators. Common signs include unusual system behavior, such as unexpected pop-ups, slow performance, or frequent crashes. Additionally, you might notice unfamiliar programs or toolbars in your browser, changes in your homepage, or an increase in spam emails being sent from your email account. In some cases, the infection might not exhibit any noticeable symptoms, making it difficult to detect without the use of security software.
How to Remove Trojan.GO.ShellcodeRunner
- Boot into Safe Mode with Networking: This will help prevent the malware from loading and give you a cleaner environment to work in. The process to boot into Safe Mode varies depending on your version of Windows.
- Perform a Full Scan with a Reputable Tool: Use a well-regarded anti-malware tool, such as SpyHunter, to scan your system. Ensure your antivirus and anti-malware definitions are up to date before scanning to increase the chances of detecting and removing the threat.
- Uninstall Suspicious Programs: Go through your list of installed programs and remove anything that you don't recognize or that was installed around the time your issues began.
- Reset Your Browsers: Resetting Chrome, Firefox, or Edge to their default settings can help remove malicious extensions or settings changes made by the malware. Be aware that this will also remove your extensions, bookmarks, and some settings.
- Reboot and Re-scan: After taking these steps, reboot your computer and perform another full scan with your anti-malware tool to ensure that the threat has been fully removed.
Conclusion
Removing Trojan.GO.ShellcodeRunner requires careful and immediate action to prevent further damage to your system and to protect your personal data. By following the steps outlined above and maintaining good security practices, such as keeping your software up to date, using strong passwords, and being cautious with emails and downloads, you can significantly reduce the risk of future infections. Remember, prevention is key, but when infections do occur, swift and informed action is crucial to minimizing their impact.
Analysis Report
General information
| Family Name: | Trojan.GO.ShellcodeRunner |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
ed0c0b413bbc5b51f367a12d084bd81c
SHA1:
cad035d8627289c02e9225678fe2c378eb6fcd41
SHA256:
8CDC955D3B984EF389B30C4038A8961A379EFF7A03372D0CD9954D3631F9D9BB
File Size:
2.38 MB, 2383360 bytes
|
|
MD5:
4536462f2b91d3aa2a321430be4641c6
SHA1:
9981bc37648e38aa78c70d7e885e49aeb1bd48e8
SHA256:
B59B774AC7D7246A1FB67A98A8641213631869402ED4E1A893545337D6621A07
File Size:
2.39 MB, 2386432 bytes
|
|
MD5:
87c44e52966e4b9f1b4c8bccbf782f12
SHA1:
945b6ba54fa4979fdd2b5b94845800dfd483fde9
SHA256:
75CDE5A1641FEB23A96308A9DD2BDF9DC3C25134254877EA230DD55FC477DAAC
File Size:
2.45 MB, 2447872 bytes
|
|
MD5:
ddaf4e2da7ab151d75677ae442a5f78b
SHA1:
f8ac1a9901c5d10adeb808c3786c67560f409ea4
SHA256:
60E4F3ADC0A2C5FC5DA9B1663B6526B479DD4004F4343351AAAB83DAD71EF93F
File Size:
2.38 MB, 2383360 bytes
|
|
MD5:
ed3db1cf86bc400689045c1a6c3ffc3f
SHA1:
b3d604354d83db2ce21ff1366ef72e39bb27c877
SHA256:
0ACDB40B806FA56B8A8579D46EB96B014BE332868660D243B1DBDDBB34394300
File Size:
2.39 MB, 2387968 bytes
|
Show More
|
MD5:
4707b1fcdf43d758497a87cc8c54f759
SHA1:
f924516dcce9e17b1cfc71464b361d6c11d0a955
SHA256:
2C5C20DE34024CCF4007B0720AD84624A750674F07908849D2170125172F182C
File Size:
2.42 MB, 2415616 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have resources
- File doesn't have security information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- golang
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 4,080 |
|---|---|
| Potentially Malicious Blocks: | 20 |
| Whitelisted Blocks: | 4,035 |
| Unknown Blocks: | 25 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.IDA
- Agent.JFH
- Agent.KOFA
- Dropper.FF
- Dropper.JC
Show More
- Filecoder.PFA
- Kryptik.FSK
- Trojan.ShellcodeRunner.Gen.FC
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Network Winsock2 |
|
