Categories: Ransom

Mal/Ransom-AI malicious file

The Mal/Ransom-AI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/Ransom-AI virus can do?

Creates RWX memory
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Installs itself for autorun at Windows startup
Creates a hidden or system file
Network activity detected but not expressed in API logs
Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Mal/Ransom-AI?


File Info:
crc32: 320DDB5Bmd5: c23884a8b9e0ecd347bf0655fd24e031name: winlocker_606072.exesha1: 8302c4fbaab61a0ba74d1404d2e5a5ef013f2776sha256: d3f987cc65e2a2b3072a054b9b557d148c44f1b2eb766fcd8e72585e81a89432sha512: b715b2136286a09286923e76e76fea1a32da3001ffab400c487619f98bf88771458a3454d601098dc665c36c07dc06d5a6195753cf36a6556ef5c8164514dbd2ssdeep: 12288:thxp3lZnT9bDPNIEjgVtYmppppppppppppppppppppppppppqyZ3U7u6jvnXRsLe:tJlh9bDFBjgVtYhyZyfhxAEtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Mal/Ransom-AI also known as:

MicroWorld-eScan	Trojan.GenericKD.31356460
CMC	Trojan-Ransom.Win32.Birele!O
CAT-QuickHeal	Ransom.Weenloc.A8
ALYac	Trojan.GenericKD.31356460
AegisLab	Trojan.Win32.Blocker.4!c
BitDefender	Trojan.GenericKD.31356460
K7GW	Trojan ( 0039911e1 )
K7AntiVirus	Trojan ( 0039911e1 )
TrendMicro	Ransom_WINLOCK.SM
Baidu	Win32.Trojan.LockScreen.b
NANO-Antivirus	Trojan.Win32.Fullscreen.crnep
Cyren	W32/Trojan.GDVD-7096
Symantec	Trojan.Ransomlock
TotalDefense	Win32/Ransom.BAM
TrendMicro-HouseCall	Ransom_WINLOCK.SM
Paloalto	generic.ml
GData	Trojan.GenericKD.31356460
Kaspersky	Trojan-Ransom.Win32.Blocker.jzec
ViRobot	Trojan.Win32.Z.Fullscreen.563978
Rising	Trojan.Win32.Weenloc.a (CLOUD)
Ad-Aware	Trojan.GenericKD.31356460
Emsisoft	Trojan.GenericKD.31356460 (B)
Comodo	Malware@#37t4xvab89oqt
F-Secure	Dropper.DR/Delphi.Gen4
DrWeb	Trojan.Winlock.3333
Zillya	Trojan.Fullscreen.Win32.36
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.hc
Trapmine	malicious.high.ml.score
Sophos	Mal/Ransom-AI
F-Prot	W32/Trojan2.OAEZ
Jiangmin	Trojan/Fullscreen.ak
Avira	DR/Delphi.Gen4
Antiy-AVL	Trojan[Ransom]/Win32.PornoAsset.cioy
Kingsoft	VIRUS_UNKNOWN
Arcabit	Trojan.Generic.D1DE762C
ZoneAlarm	Trojan-Ransom.Win32.Blocker.jzec
Microsoft	Ransom:Win32/Weenloc.A
McAfee	Artemis!C23884A8B9E0
MAX	malware (ai score=100)
VBA32	TScope.Trojan.Delf
Cylance	Unsafe
Panda	Trj/CI.A
Zoner	Trojan.Win32.46437
ESET-NOD32	a variant of Win32/LockScreen.AGU
Tencent	Win32.Trojan.Blocker.Svgy
Yandex	Trojan.WinBlock.Black.Gen.AA
Ikarus	Trojan-Ransom.Win32.Birele
Fortinet	W32/LockScreen.AGU!tr
AVG	Win32:Evo-gen [Susp]
Cybereason	malicious.8b9e0e
Avast	Win32:Evo-gen [Susp]
CrowdStrike	malicious_confidence_80% (W)
Qihoo-360	HEUR/QVM41.2.4923.Malware.Gen