Trojan.GO.ShellcodeRunner
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 10,083 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 38 |
| First Seen: | February 29, 2024 |
| Last Seen: | November 1, 2026 |
| OS(es) Affected: | Windows |
Your system has been detected to be infected with the Trojan.GO.ShellcodeRunner threat. This detection indicates that your computer is likely compromised by a type of malicious software designed to execute arbitrary code, potentially leading to various security issues and vulnerabilities. It is essential to understand the nature of this threat and take immediate action to remove it and protect your system.
Table of Contents
What Is Trojan.GO.ShellcodeRunner?
Trojan.GO.ShellcodeRunner, as the name suggests, is associated with Trojan-type malware. Trojans are malicious programs that disguise themselves as legitimate software, allowing them to bypass security mechanisms and infiltrate computer systems. Once inside, they can perform a wide range of harmful activities, including data theft, espionage, and the installation of additional malware. The term "ShellcodeRunner" implies that this particular threat is designed to execute shellcode, which is a small piece of code used as the payload in the exploitation of a software vulnerability. Shellcode is typically used to create a backdoor, allowing an attacker to access the system remotely.
How Trojan.GO.ShellcodeRunner Operates
The operation of Trojan.GO.ShellcodeRunner, like many Trojans, involves exploiting vulnerabilities in software or tricking users into installing it. Once installed, it can operate in stealth mode, hiding from the user and security software. Its primary function is to execute shellcode, which can lead to the installation of other malware, the theft of sensitive information, or the use of the infected computer as part of a botnet for malicious activities such as DDoS attacks or spamming.
Symptoms of Infection
Symptoms of a Trojan.GO.ShellcodeRunner infection can vary widely depending on its payload and the intentions of its creators. Common signs include unusual system behavior, such as unexpected pop-ups, slow performance, or frequent crashes. Additionally, you might notice unfamiliar programs or toolbars in your browser, changes in your homepage, or an increase in spam emails being sent from your email account. In some cases, the infection might not exhibit any noticeable symptoms, making it difficult to detect without the use of security software.
How to Remove Trojan.GO.ShellcodeRunner
- Boot into Safe Mode with Networking: This will help prevent the malware from loading and give you a cleaner environment to work in. The process to boot into Safe Mode varies depending on your version of Windows.
- Perform a Full Scan with a Reputable Tool: Use a well-regarded anti-malware tool, such as SpyHunter, to scan your system. Ensure your antivirus and anti-malware definitions are up to date before scanning to increase the chances of detecting and removing the threat.
- Uninstall Suspicious Programs: Go through your list of installed programs and remove anything that you don't recognize or that was installed around the time your issues began.
- Reset Your Browsers: Resetting Chrome, Firefox, or Edge to their default settings can help remove malicious extensions or settings changes made by the malware. Be aware that this will also remove your extensions, bookmarks, and some settings.
- Reboot and Re-scan: After taking these steps, reboot your computer and perform another full scan with your anti-malware tool to ensure that the threat has been fully removed.
Conclusion
Removing Trojan.GO.ShellcodeRunner requires careful and immediate action to prevent further damage to your system and to protect your personal data. By following the steps outlined above and maintaining good security practices, such as keeping your software up to date, using strong passwords, and being cautious with emails and downloads, you can significantly reduce the risk of future infections. Remember, prevention is key, but when infections do occur, swift and informed action is crucial to minimizing their impact.
Analysis Report
General information
| Family Name: | Trojan.GO.ShellcodeRunner |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
ed0c0b413bbc5b51f367a12d084bd81c
SHA1:
cad035d8627289c02e9225678fe2c378eb6fcd41
SHA256:
8CDC955D3B984EF389B30C4038A8961A379EFF7A03372D0CD9954D3631F9D9BB
File Size:
2.38 MB, 2383360 bytes
|
|
MD5:
4536462f2b91d3aa2a321430be4641c6
SHA1:
9981bc37648e38aa78c70d7e885e49aeb1bd48e8
SHA256:
B59B774AC7D7246A1FB67A98A8641213631869402ED4E1A893545337D6621A07
File Size:
2.39 MB, 2386432 bytes
|
|
MD5:
87c44e52966e4b9f1b4c8bccbf782f12
SHA1:
945b6ba54fa4979fdd2b5b94845800dfd483fde9
SHA256:
75CDE5A1641FEB23A96308A9DD2BDF9DC3C25134254877EA230DD55FC477DAAC
File Size:
2.45 MB, 2447872 bytes
|
|
MD5:
ddaf4e2da7ab151d75677ae442a5f78b
SHA1:
f8ac1a9901c5d10adeb808c3786c67560f409ea4
SHA256:
60E4F3ADC0A2C5FC5DA9B1663B6526B479DD4004F4343351AAAB83DAD71EF93F
File Size:
2.38 MB, 2383360 bytes
|
|
MD5:
ed3db1cf86bc400689045c1a6c3ffc3f
SHA1:
b3d604354d83db2ce21ff1366ef72e39bb27c877
SHA256:
0ACDB40B806FA56B8A8579D46EB96B014BE332868660D243B1DBDDBB34394300
File Size:
2.39 MB, 2387968 bytes
|
Show 7 more
|
MD5:
4707b1fcdf43d758497a87cc8c54f759
SHA1:
f924516dcce9e17b1cfc71464b361d6c11d0a955
SHA256:
2C5C20DE34024CCF4007B0720AD84624A750674F07908849D2170125172F182C
File Size:
2.42 MB, 2415616 bytes
|
|
MD5:
fb8f76842615c7112b273291b892424c
SHA1:
b7eacb455751f79adec545fab2117c8190b02915
SHA256:
20DCB1365D72B9BE133D7EFCC14F813EC88A4D7BD0772815BCA3016E34DD8BF2
File Size:
2.39 MB, 2386432 bytes
|
|
MD5:
cf0fc11795fcc051de97714ea32ee9f1
SHA1:
a3bb3a96d6975d4f99b3f0cca845056b54782c64
SHA256:
EFCC5CBFA487D969B70E9AF533B8EB318F95872E68A7D4016117663D8EDE0DC0
File Size:
6.39 MB, 6388736 bytes
|
|
MD5:
165f9be09201ba00e8ff4b0400259e4e
SHA1:
02ec17db238795a4b7528d9c64a61fbca4ecb338
SHA256:
8C5340A2F85A2CDE98FB157A2241ABEEA1BEC5C0298E36ABEEAF0800BFDB2150
File Size:
6.41 MB, 6406072 bytes
|
|
MD5:
42ef5011b6d8949c3681def62845e478
SHA1:
a4e383336e62aef4599fc25137fc9919559e8946
SHA256:
8EC1F4F7EA7D305DFA04877528325243FA488D12616871C6E846A1F45E659F3C
File Size:
6.41 MB, 6411264 bytes
|
|
MD5:
8a8dee861fb2cdac7454a958c73c4210
SHA1:
fd5b6b6aa49162b796684c36a6ca001ba9dfc9dc
SHA256:
662119644B7E35B0ED46F6E397FDE8118E767DB35508EED2DC5D36A2F4AD0DCD
File Size:
2.64 MB, 2636192 bytes
|
|
MD5:
b67f611c66de1b68b2b8ff00e446710c
SHA1:
7a656945a3424f501ac1c03cd9c7525964526e02
SHA256:
4732C131185FD4526D8D13CC21A2EF3C4F80BBD09F47437DF04E32F3A979CCBF
File Size:
6.09 MB, 6085632 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have resources
- File doesn't have security information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show 2 more
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | Microsoft Corporation |
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright | © Microsoft Corporation. All rights reserved. |
| Original Filename |
|
| Product Name | Microsoft® Windows® Operating System |
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Microsoft Windows | Microsoft Windows Production PCA 2011 | Hash Mismatch |
File Traits
- golang
- HighEntropy
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 4,188 |
|---|---|
| Potentially Malicious Blocks: | 15 |
| Whitelisted Blocks: | 4,030 |
| Unknown Blocks: | 143 |
Visual Map
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.IDA
- Agent.JFH
- Agent.KOFA
- Agent.MPGA
- Dropper.FF
Show 19 more
- Dropper.JC
- Filecoder.PFA
- Kryptik.BFRL
- Kryptik.BFSM
- Kryptik.BFST
- Kryptik.FSK
- Kryptik.GDSY
- Kryptik.GOB
- Kryptik.GRH
- Kryptik.MFRA
- Kryptik.MFRB
- Kryptik.MFRC
- Kryptik.MFS
- Kryptik.MTB
- Kryptik.NFTB
- Trojan.ClipBanker.Gen.A
- Trojan.ClipBanker.Gen.C
- Trojan.Krypt.Gen.ACJA
- Trojan.ShellcodeRunner.Gen.FC
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\assets | Generic Read,Write Data,Write Attributes,Write extended,Delete,LEFT 262144 |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\assets\background.ts-ssrpou6d.js | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\assets\background.ts-ssrpou6d.js | Generic Write,Read Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\assets\background.ts-ssrpou6d.js | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\assets\content.ts-b6xgi__y.js | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\assets\content.ts-b6xgi__y.js | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\assets\csp-strip.ts-dri45pku.js | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\assets\csp-strip.ts-dri45pku.js | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\host\com.lunex.explorer.json | Generic Write,Read Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\host\host.bat | Generic Write,Read Attributes |
Show 29 more
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\host\host.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icon.png | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icon.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icons | Generic Read,Write Data,Write Attributes,Write extended,Delete,LEFT 262144 |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icons\128.png | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icons\128.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icons\16.png | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icons\16.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icons\32.png | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icons\32.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icons\48.png | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\icons\48.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\manifest.json | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\manifest.json | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\rules | Generic Read,Write Data,Write Attributes,Write extended,Delete,LEFT 262144 |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\rules\strip_csp.json | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\rules\strip_csp.json | Synchronize,Write Attributes |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\service-worker-loader.js | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\packages\extensions\bc5f1cda8712468b1ef271ea62fdb5da75a79d8c09b7a06279142c2441674a66\e0\service-worker-loader.js | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ext33ed.tmp.zip | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\0htlll42tycd\6qmcu7uc.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\0htlll42tycd\6qmcu7uc.exe | Read Attributes,Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\dtlw4vj9mi0t\lxpr2q1ymq.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\dtlw4vj9mi0t\lxpr2q1ymq.exe | Read Attributes,Synchronize,Write Attributes |
| c:\users\user\downloads\02ec17db238795a4b7528d9c64a61fbca4ecb338_0006406072 | Read Attributes,Synchronize,Write Attributes |
| c:\users\user\downloads\7a656945a3424f501ac1c03cd9c7525964526e02_0006085632 | Read Attributes,Synchronize,Write Attributes |
| c:\users\user\downloads\a3bb3a96d6975d4f99b3f0cca845056b54782c64_0006388736 | Read Attributes,Synchronize,Write Attributes |
| c:\users\user\downloads\a4e383336e62aef4599fc25137fc9919559e8946_0006411264 | Read Attributes,Synchronize,Write Attributes |
| c:\users\user\downloads\fd5b6b6aa49162b796684c36a6ca001ba9dfc9dc_0002636192 | Read Attributes,Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\run::6qmcu7uc | C:\Users\Djbylbrf\AppData\Roaming\0htlll42tycd\6qmcu7uc.exe | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\run::lxpr2q1ymq | C:\Users\Thxpugox\AppData\Roaming\dtlw4vj9mi0t\lxpr2q1ymq.exe | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\google\chrome\nativemessaginghosts\com.lunex.explorer:: | C:\Users\Vwvriosh\AppData\Local\Packages\Extensions\BC5F1CDA8712468B1EF271EA62FDB5DA75A79D8C09B7A06279142C2441674A66\e0\host\com | RegNtPreCreateKey |
| HKCU\software\microsoft\edge\nativemessaginghosts\com.lunex.explorer:: | C:\Users\Vwvriosh\AppData\Local\Packages\Extensions\BC5F1CDA8712468B1EF271EA62FDB5DA75A79D8C09B7A06279142C2441674A66\e0\host\com | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show 90 more
27 additional items are not displayed above. |
| Network Winsock2 |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\Users\Djbylbrf\AppData\Roaming\0htlll42tycd\6qmcu7uc.exe C:\Users\Djbylbrf\AppData\Roaming\0htlll42tycd\6qmcu7uc.exe
|
C:\Users\Thxpugox\AppData\Roaming\dtlw4vj9mi0t\lxpr2q1ymq.exe C:\Users\Thxpugox\AppData\Roaming\dtlw4vj9mi0t\lxpr2q1ymq.exe
|
