About “Ransom.1122” infection

The Ransom.1122 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.1122 virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ransom.1122?


File Info:
crc32: E5F35FAB
md5: a9f589b136774013b5633eb6952c8492
name: A9F589B136774013B5633EB6952C8492.mlw
sha1: 538c3432e076df27c15f074fef77ec69584d07da
sha256: 4ea8164c562364d6916057155b53374eb3e221735c1214b49e0c8c2f33541a5b
sha512: 7b536f324dfed3996343ce59f5eb0ef8377b3667fac85d702252207a63a80f9c63cda80196c8f4faa3ebf56c81aa21ef5a2365fddb02db531a8515e8b90453ca
ssdeep: 192:YXFx6HJEQ+WjAu9CqS27NCN8jkoOSJKCJn2Igfm6v00pK:YXCHGQ1bCqS27NCgNkHfnXp
type: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2016
Assembly Version: 1.0.0.0
InternalName: Virus 1.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: Virus 1
ProductVersion: 1.0.0.0
FileDescription: Virus 1
OriginalFilename: Virus 1.exe

Ransom.1122 also known as:

MicroWorld-eScan	Gen:Variant.Ransom.1122
McAfee	Artemis!A9F589B13677
BitDefender	Gen:Variant.Ransom.1122
Cybereason	malicious.136774
Symantec	ML.Attribute.HighConfidence
Avast	FileRepMalware
Alibaba	Trojan:MSIL/Filecoder.55442aba
Tencent	Win32.Trojan.Ransom.Lqor
Ad-Aware	Gen:Variant.Ransom.1122
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1110069
Zillya	Trojan.Filecoder.Win32.8398
McAfee-GW-Edition	Artemis
SentinelOne	Static AI – Malicious PE
FireEye	Gen:Variant.Ransom.1122
Emsisoft	Gen:Variant.Ransom.1122 (B)
Ikarus	Trojan-Ransom.FileCrypter
Avira	HEUR/AGEN.1110069
Antiy-AVL	Trojan/Win32.Occamy
Microsoft	Trojan:Win32/Occamy.C
Arcabit	Trojan.Ransom.D462
GData	Gen:Variant.Ransom.1122
Cynet	Malicious (score: 85)
VBA32	Trojan.MSIL.gen.5
ALYac	Gen:Variant.Ransom.1122
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/GdSda.A
APEX	Malicious
ESET-NOD32	MSIL/Filecoder.OY
Rising	Trojan.Filecoder!8.68 (CLOUD)
Yandex	Trojan.Filecoder!mJo7gtjAum0
Fortinet	MSIL/Filecoder.OY!tr.ransom
AVG	FileRepMalware
Qihoo-360	Win32/Trojan.Ransom.483

How to remove Ransom.1122?

Ransom.1122 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X