About “Ransom.801” infection

The Ransom.801 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.801 virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

How to determine Ransom.801?


File Info:
crc32: 44C02470
md5: 3c5b540a8bc45eab2ef6276a8a00e83a
name: 3C5B540A8BC45EAB2EF6276A8A00E83A.mlw
sha1: ca7a262f52d71a6344e6803f09d45c460db36b30
sha256: 40f9df01c18acfcfc277655c9d7986d2567c8f1d4b4a17580e12b83531a9f5c8
sha512: 7bb90b89047f7687835221106440c02396ab980889c940045bce391e58c58d6b483a8691c38c15df27a3a006c08e889983536fa457e88d84c5628982d7ee058f
ssdeep: 3072:QPYZfrUOWiMfsvAM/wmYU30VFzKLPkR/ouP2ov3QD0fGrnHRkM6u:QQUFRsvAMYmCV5ouiD0gnHRkV
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2018
Assembly Version: 1.0.0.0
InternalName: WindowsApplication14.exe
FileVersion: 1.0.0.0
ProductName: WindowsApplication14
ProductVersion: 1.0.0.0
FileDescription: WindowsApplication14
OriginalFilename: WindowsApplication14.exe

Ransom.801 also known as:

K7AntiVirus	Trojan ( 00534c141 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ransom.801
Zillya	Trojan.GenericKD.Win32.169185
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	Trojan:MSIL/Generic.39b7f155
K7GW	Trojan ( 00534c141 )
Cybereason	malicious.a8bc45
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.ETC
APEX	Malicious
Avast	Win32:Malware-gen
BitDefender	Gen:Variant.Ransom.801
NANO-Antivirus	Trojan.Win32.Mlw.fhcadj
MicroWorld-eScan	Gen:Variant.Ransom.801
Tencent	Msil.Trojan.Dropper.Llhr
Ad-Aware	Gen:Variant.Ransom.801
Comodo	Malware@#7jw90fq7y37s
BitDefenderTheta	Gen:NN.ZemsilF.34790.vm0@a4q2rFp
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.3c5b540a8bc45eab
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Avira	TR/Dropper.MSIL.Gen
Arcabit	Trojan.Ransom.801
AegisLab	Trojan.Win32.Generic.m2Da
GData	Gen:Variant.Ransom.801
AhnLab-V3	Trojan/Win32.Bladabindi.C2503954
McAfee	Artemis!3C5B540A8BC4
MAX	malware (ai score=99)
Panda	Trj/GdSda.A
Yandex	Trojan.DR.Agent!2DDO77UxoSU
Ikarus	Trojan.MSIL.Crypt
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Agent.DTT!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/TrojanDropper.Generic.HwMAEpsA

How to remove Ransom.801?

Ransom.801 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X