Ransom

Generic.Ransom.WCryG.AC9CF475 (file analysis)

Malware Removal

The Generic.Ransom.WCryG.AC9CF475 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Generic.Ransom.WCryG.AC9CF475 virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Unconventionial binary language: Portuguese (Brazil)
  • Unconventionial language used in binary resources: Portuguese (Brazilian)
  • The binary likely contains encrypted or compressed data.
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

How to determine Generic.Ransom.WCryG.AC9CF475?



File Info:

crc32: A1654FC1
md5: dabdb65b9732b668115a463ea9ed116b
name: DABDB65B9732B668115A463EA9ED116B.mlw
sha1: 5ebf82e199c4f6f996b5c806beaf56f24860ecb0
sha256: 2ef7c163b2c76dd308a3bf6226e6db0dd012377546930af19e1211952b0ce84d
sha512: c98cae3f13cc70594eb2e831b89a52dce2598daa598a46660e3e0b29ec6bd9b519884c835ae1823cd33094e15b1bc047a73146b4b28f7ee52402615d759aa6d1
ssdeep: 6144:hESSGkvc3x4vnGrZwd7OTOF1b2AcnPymb0NMTwRK3hFnAtGg7Ghu/HctDuji1PP:hKGkU32PSZIH7cn3dpdgbADuwPP
type: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed


Version Info:

LegalCopyright: xa9 Microsoft Corporation. Todos os direitos reservados.
FileVersion: 6.1.7600.16385
CompanyName: Microsoft Corporation
ProductName: Sistema Operacional Microsoftxae Windowsxae
ProductVersion: 6.1.7600.16385
FileDescription: Microsoft DirectX Diagnostic Tool
OriginalFilename: dxdiag_.exe
Translation: 0x0416 0x04e4

Generic.Ransom.WCryG.AC9CF475 also known as:

BkavW32.AIDetect.malware2
K7AntiVirusTrojan ( 005376ae1 )
Elasticmalicious (high confidence)
ALYacGeneric.Ransom.WCryG.AC9CF475
CylanceUnsafe
ZillyaTrojan.Delf.Win32.27168
SangforTrojan.Win32.Save.a
AlibabaTrojanSpy:Win32/Banker.e28c77c1
K7GWTrojan ( 005376ae1 )
Cybereasonmalicious.b9732b
CyrenW32/SysVenFak.B.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Spy.Banker.AAKC
APEXMalicious
AvastFileRepMalware
ClamAVWin.Trojan.Delf-20462
KasperskyTrojan-Spy.Win32.Delf.kus
BitDefenderGeneric.Ransom.WCryG.AC9CF475
NANO-AntivirusTrojan.Win32.Delf.elsixp
MicroWorld-eScanGeneric.Ransom.WCryG.AC9CF475
Ad-AwareGeneric.Ransom.WCryG.AC9CF475
SophosMal/Banker-U
ComodoTrojWare.Win32.Spy.Banker.Gen@1qlojk
BitDefenderThetaAI:Packer.543E9B001C
VIPRETrojan.Win32.Generic!BT
TrendMicroTSPY_BANKER.MJM
McAfee-GW-EditionBehavesLike.Win32.Generic.gc
FireEyeGeneric.mg.dabdb65b9732b668
EmsisoftGeneric.Ransom.WCryG.AC9CF475 (B)
SentinelOneStatic AI – Suspicious PE
JiangminTrojanSpy.Delf.gig
WebrootW32.InfoStealer.Banker
eGambitUnsafe.AI_Score_92%
Antiy-AVLTrojan/Generic.ASMalwS.1B3DA0
KingsoftWin32.Troj.Delf.k.(kcloud)
MicrosoftTrojan:Win32/Wacatac.B!ml
GDataGeneric.Ransom.WCryG.AC9CF475
AhnLab-V3Trojan/Win32.Dynamer.R158386
McAfeeArtemis!DABDB65B9732
MAXmalware (ai score=100)
PandaGeneric Malware
TrendMicro-HouseCallTSPY_BANKER.MJM
YandexTrojanSpy.Delf!WS/BnFiUDng
IkarusTrojan-Spy.Win32.Delf
FortinetW32/Delf.KUS!tr
AVGFileRepMalware

How to remove Generic.Ransom.WCryG.AC9CF475?

Generic.Ransom.WCryG.AC9CF475 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment