Should I remove “Ransom.1343”?

The Ransom.1343 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.1343 virus can do?

• Executable code extraction
• Attempts to connect to a dead IP:Port (1 unique times)
• A process attempted to delay the analysis task.
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Deletes its original binary from disk
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Creates a copy of itself

Related domains:

How to determine Ransom.1343?

File Info:
crc32: C5B7435F
md5: 0abaa7582eb832c025cd8f374204485c
name: 2154.exe
sha1: 6fc1e18c75b82a1402ab0f67efc820763635d44f
sha256: 8e925270b188cba0d5be5540680cc166ac6fc7380ad78926329a29f8bb445866
sha512: 2f3d02bad8cf7d2a0e708d75085ecc0f2039649c752941ec57258ae2afab58f90902861683a47eaa43a8fe87ef477322a5e7bd7006194fdc45d2119f28e4a7bc
ssdeep: 768:yoVrrGCwdIkfN4N8aCyBZE9+zCTe1prb:v1rGDdm8yCESY
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: x7248x6743x6240x6709 (C) 2017
InternalName: NewServers
FileVersion: 1, 0, 0, 1
CompanyName: 
LegalTrademarks: 
ProductName: NewServers x5e94x7528x7a0bx5e8f
ProductVersion: 1, 0, 0, 1
FileDescription: NewServers Microsoft x57fax7840x7c7bx5e94x7528x7a0bx5e8f
OriginalFilename: NewServers.EXE
Translation: 0x0804 0x04b0

Ransom.1343 also known as:

How to remove Ransom.1343?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.