Trojan.Boxter.D

The detection of Trojan.Boxter.D on your system indicates a potential security threat that requires immediate attention. This detection name suggests a type of malicious software, but without more specific information, it's essential to approach removal with general best practices for dealing with Trojan-type threats.

What Is Trojan.Boxter.D?

Trojan.Boxter.D, as indicated by its name, is likely a variant of Trojan horse malware. Trojan horses are malicious programs that disguise themselves as legitimate software but actually allow unauthorized access to a computer, once installed. They can lead to a range of problems, including data theft, system crashes, and the installation of additional malware. The specific behaviors and impacts of Trojan.Boxter.D would depend on its design and the intentions of its creators, which can vary widely among different types of Trojans.

How Trojan.Boxter.D Operates

Trojan-type malware, including potential threats like Trojan.Boxter.D, typically operate by exploiting vulnerabilities in software or tricking users into installing them. Once installed, they can create backdoors for remote access, steal sensitive information, disrupt system operation, or deploy additional malicious components. The exact operation of Trojan.Boxter.D would depend on its specific coding and the goals of its developers, but common behaviors include communicating with command and control servers, downloading other malware, and modifying system settings to evade detection.

Symptoms of Infection

Symptoms of a Trojan infection can vary but often include noticeable system slowdowns, frequent crashes, appearance of unwanted programs or toolbars, and unusual network activity. Users might also notice that their personal files are being encrypted or that they are being redirected to unwanted websites. In some cases, the infection might not display obvious symptoms, making it difficult for users to detect without the aid of security software.

• Unexplained changes in system settings or appearance
• Increased popup ads or unwanted software installations
• Difficulty in accessing personal files or finding them encrypted
• Unusual network activity when no programs are running

How to Remove Trojan.Boxter.D

1. Boot into Safe Mode with Networking: This will limit the malware's ability to interfere with the removal process. To do this, restart your computer, and as it boots up, press the F8 key repeatedly until you see the Advanced Boot Options. Use the arrow keys to select Safe Mode with Networking and press Enter.
2. Perform a Full Scan with a Reputable Tool: Use an anti-malware program like SpyHunter to scan your system thoroughly. Ensure the software is updated to the latest version to improve detection rates.
3. Uninstall Suspicious Programs: Go through your installed programs and remove any that you don't recognize or that were installed around the time the malware was detected.
4. Reset Your Web Browsers: Malware often affects web browsers like Chrome, Firefox, or Edge. Resetting these browsers to their default settings can help remove malicious extensions or settings. You can usually find this option in the browser's settings or preferences menu.
5. Reboot and Re-scan: After taking the above steps, restart your computer in normal mode and perform another scan with your anti-malware tool to ensure that the threat has been fully removed.

Conclusion

Removing Trojan.Boxter.D requires careful steps to ensure that the malware is completely eradicated from your system. It's crucial to stay vigilant and keep your security software updated to protect against future threats. Regular system backups, cautious internet browsing habits, and avoiding suspicious downloads are also key to maintaining system security. If you're unsure about any part of the removal process, consider consulting with a professional to avoid causing further damage to your system.

Analysis Report

General information

Family Name:	Trojan.Boxter.D
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 16df26b45baab907097c0e12a7fec620 SHA1: 959e0f93d3ed7461dc2986c1bc0f55972cc778cf File Size: 5.85 MB, 5848183 bytes

MD5: b20702d358acf85d412ddcb093867925 SHA1: 314dc0cc8c3ba04b24110008ae00a54246bd29e3 SHA256: 2D59D834FA600731C0E7C0B5CFCE580AEA77E63D676645A33470A1CF33D5F803 File Size: 7.52 MB, 7521899 bytes

MD5: 9b1b2e0ee54cb8db01bf844afb9899af SHA1: 1b1be6e50d76bbccaaa5833554bc80c65deb7491 SHA256: 054C88E00981DA495DF47526614C6FDEC9D0F62BE0E3C44D6CDC585E4C247E3C File Size: 5.95 MB, 5952770 bytes

MD5: ace0ca86cd02b05a93025837cc0b9078 SHA1: 7bde8599b83eb8811c23861262328a15ca9191e7 SHA256: CA87D099D4935C978B55978B58BF657CB38C4B2DE4D7DD33A8CB1F56BC25D81A File Size: 429.31 KB, 429311 bytes

MD5: d6bb7f91695351274c46568ba2724f10 SHA1: ce9dd2504a3504dace72a7ec4a50ad39f27d7278 SHA256: C12E688A63D2213B1C8122B024832EFC7766FB20DA7959BFF3162F6214C79AA6 File Size: 7.25 MB, 7253816 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Bandisoft
File Description	Bandizip 7.32 0 Setup Bandizip Professional x64
File Version	7.32 1.00
Internal Name	TJprojMain
Legal Copyright	Copyright(C) 2011-2023, Bandisoft International Inc. All rights reserved.
Original Filename	TJprojMain.exe
Product Name	Project1
Product Version	7.32 1.00

File Traits

• HighEntropy
• No Version Info
• WinZip SFX
• x86
• ZIP (In Overlay)

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\srvsvc	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\002ca40a_rar\ce9dd2504a3504dace72a7ec4a50ad39f27d7278_0007253816	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\002ca40a_rar\ce9dd2504a3504dace72a7ec4a50ad39f27d7278_0007253816	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\windows\system.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalldisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::uacdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalldisablenotify		RegNtPreCreateKey

Show More

HKLM\software\wow6432node\microsoft\security center\svc::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::uacdisablenotify		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline		RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\policies\system::enablelua		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::enablefirewall		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::donotallowexceptions		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::disablenotifications		RegNtPreCreateKey
HKCU\software\apcr\1214104697::1919251317		RegNtPreCreateKey
HKCU\software\apcr\1214104697::-456464662		RegNtPreCreateKey
HKCU\software\apcr\1214104697::1462786655		RegNtPreCreateKey
HKCU\software\apcr\1214104697::-912929324	#	RegNtPreCreateKey
HKCU\software\apcr\1214104697::1006321993	ǜ	RegNtPreCreateKey
HKCU\software\apcr\1214104697::-1369393986	http://www.ledyazilim.com/logo.gifhttp://ksandrafashion.com/l	RegNtPreCreateKey
HKCU\software\apcr\1214104697::549857331	��/�L�!���q%Fg+��>����)�p`�SI弱U�,C&�� �B��R��'�LU"�	RegNtPreCreateKey
HKCU\software\apcr::u1_0	䡴⬋	RegNtPreCreateKey
HKCU\software\apcr::u2_0	ᩣ	RegNtPreCreateKey
HKCU\software\apcr::u3_0	権ă	RegNtPreCreateKey
HKCU\software\apcr::u4_0		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Other Suspicious	SetWindowsHookEx
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation