Generic.MSIL.Ransomware.Jigsaw.618D70DD (file analysis)

The Generic.MSIL.Ransomware.Jigsaw.618D70DD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic.MSIL.Ransomware.Jigsaw.618D70DD virus can do?

Creates RWX memory
Drops a binary and executes it
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Generic.MSIL.Ransomware.Jigsaw.618D70DD?


File Info:
crc32: B486C262
md5: 46f04bb606c2fd2443adf9f66d3b3bd4
name: 46F04BB606C2FD2443ADF9F66D3B3BD4.mlw
sha1: 56b2e829207936517c612b062ee23cf538e63763
sha256: d6fcfef4967730f0ad4c59023d5801f93cfcc38aaeda5c490c7b52edf14873b0
sha512: 87980bde36be1a11b2d331a0240a5319027bbee8f7128700ed8813037f6b4d42b59ee8c4f71a229efd331f0a11c91f197d0b5a09bd00f134bc877e6cfb82481b
ssdeep: 12288:BB5laYN38/ydiESYw5/UH0U2KbUEyCuDjWe+:GYM/ydrM/U/bUEEme+
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
LegalCopyright: Runtime Engine Copyright xa9 2015 MadByte Games (www.madbytegames.com)
InternalName: ams_launch
FileVersion: 1.16.4.8
CompanyName: WinLoader
Comments: Created with AutoPlay Media Studio (www.indigorose.com)
ProductName: Loader
ProductVersion: 1.17.5
FileDescription: Win Loader
OriginalFilename: Loader.exe
Translation: 0x0409 0x0000

Generic.MSIL.Ransomware.Jigsaw.618D70DD also known as:

K7AntiVirus	Password-Stealer ( 004d8d6a1 )
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop7.41094
ALYac	Generic.MSIL.Ransomware.Jigsaw.618D70DD
Cylance	Unsafe
Zillya	Trojan.CoinStealer.Win32.472
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
Alibaba	TrojanSpy:MSIL/CoinStealer.c49268e0
K7GW	Password-Stealer ( 004d8d6a1 )
Cybereason	malicious.606c2f
ESET-NOD32	a variant of MSIL/PSW.CoinStealer.AH
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Generic.MSIL.Ransomware.Jigsaw.618D70DD
NANO-Antivirus	Trojan.Win32.BitCoinMiner.eswnvf
MicroWorld-eScan	Generic.MSIL.Ransomware.Jigsaw.618D70DD
Tencent	Win32.Trojan.Generic.Pftg
Ad-Aware	Generic.MSIL.Ransomware.Jigsaw.618D70DD
Sophos	Mal/Generic-R + Mal/CoinSteal-A
Comodo	Malware@#1if063cakgnj4
F-Secure	Heuristic.HEUR/AGEN.1101086
BitDefenderTheta	Gen:NN.ZemsilF.34170.Tm0@aqonqtdi
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.bt
FireEye	Generic.mg.46f04bb606c2fd24
Emsisoft	Generic.MSIL.Ransomware.Jigsaw.618D70DD (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1101086
Antiy-AVL	Trojan/Generic.ASMalwS.21DE4D8
Microsoft	TrojanSpy:MSIL/CoinStealer.C!bit
Arcabit	Generic.MSIL.Ransomware.Jigsaw.618D70DD
GData	MSIL.Trojan.ClipBanker.C
McAfee	Artemis!46F04BB606C2
MAX	malware (ai score=99)
VBA32	Trojan.MulDrop
Panda	Trj/GdSda.A
Yandex	Trojan.Agent!SQhGcrHn8ko
Ikarus	Trojan.MSIL.PSW
Fortinet	MSIL/Generic.AP.CC87EC!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Generic.MSIL.Ransomware.Jigsaw.618D70DD?

Generic.MSIL.Ransomware.Jigsaw.618D70DD removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Generic.MSIL.Ransomware.Jigsaw.618D70DD (file analysis)