Ransom

ML/PE-A + Troj/Ransom-GGD removal tips

Malware Removal

The ML/PE-A + Troj/Ransom-GGD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What ML/PE-A + Troj/Ransom-GGD virus can do?

  • A process created a hidden window
  • Uses Windows utilities for basic functionality
  • Attempts to delete volume shadow copies
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Exhibits possible ransomware file modification behavior
  • Writes a potential ransom message to disk
  • Uses suspicious command line tools or Windows utilities

How to determine ML/PE-A + Troj/Ransom-GGD?


File Info:

crc32: B5220DFA
md5: 16c7212928b23a170cebb12935a933fa
name: 16C7212928B23A170CEBB12935A933FA.mlw
sha1: 5d316698dfe20b8fcdc881dbf68632b13af11d0f
sha256: 18e299d4331ccff805275b21f33be0a3bd3d1d9ce72a79ba78d2f32dd657bfbb
sha512: 1f3f9d2486f0d2af768dd7d3537e98a97e856318a06e6a01972c1f58c8029151cfa29cdfaceff098daf8d7ac30bbe6b7bf1aa09c3c44f33ffda8cf0d08f98f0c
ssdeep: 1536:jpfS6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:jpfMhZ5YesrQLOJgY8Zp8LHD4XWaNH7
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

ML/PE-A + Troj/Ransom-GGD also known as:

Elasticmalicious (high confidence)
DrWebTrojan.Siggen12.62665
CynetMalicious (score: 100)
ALYacGen:Heur.Ransom.REntS.Gen.1
CrowdStrikewin/malicious_confidence_70% (W)
AlibabaRansom:Win32/BabukCrypt.c423e5da
SymantecRansom.Babuk
ESET-NOD32a variant of Win32/Filecoder.Babyk.A
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Ransomware.Maze-7473772-0
KasperskyUDS:Trojan-Ransom.Win32.Generic
BitDefenderGen:Heur.Ransom.REntS.Gen.1
ViRobotTrojan.Win32.Ransom.80896.E
MicroWorld-eScanGen:Heur.Ransom.REntS.Gen.1
Ad-AwareGen:Heur.Ransom.REntS.Gen.1
SophosML/PE-A + Troj/Ransom-GGD
BitDefenderThetaGen:NN.ZexaF.34670.euW@aWBl0ug
McAfee-GW-EditionBehavesLike.Win32.Generic.lm
FireEyeGeneric.mg.16c7212928b23a17
EmsisoftTrojan.FileCoder (A)
SentinelOneStatic AI – Malicious PE
MicrosoftRansom:Win32/BabukCrypt.PA!MSR
ArcabitTrojan.Ransom.REntS.Gen.1
ZoneAlarmHEUR:Trojan-Ransom.Win32.Generic
GDataWin32.Trojan-Ransom.Babuk.A
TACHYONRansom/W32.BabukLocker.80896.B
AhnLab-V3Trojan/Win32.BabukRansom.C4337300
Acronissuspicious
McAfeeGenericRXNS-AS!16C7212928B2
MAXmalware (ai score=80)
VBA32BScope.TrojanRansom.Gen
MalwarebytesMalware.AI.1000942615
PandaTrj/GdSda.A
RisingRansom.Generic!8.E315 (CLOUD)
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/FilecoderProt.F183!tr.ransom
AVGWin32:Malware-gen
Paloaltogeneric.ml
Qihoo-360Win32/Ransom.Generic.HxQBi3sA

How to remove ML/PE-A + Troj/Ransom-GGD?

ML/PE-A + Troj/Ransom-GGD removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment