Categories: Ransom

Ransom.Atlas.1 removal tips

The Ransom.Atlas.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Atlas.1 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Looks up the external IP address

Related domains:

checkip.dyndns.org

How to determine Ransom.Atlas.1?


File Info:
crc32: 5E30C886md5: aa31d1ad77ff04318fdf355f41194233name: AA31D1AD77FF04318FDF355F41194233.mlwsha1: a152796dcb795ec7df155f147a29a6b53cd9355fsha256: ae67f263becdf449d12b76a5c2dbad5c6b471ea457d947b93a7aaf029743c621sha512: 671cf7e7ade886bddb99775d176e3050562774ffa9720605b1da132e84e5390a93fcf9e490cf863708587d890d632fb2b854c137945ca8c0e65c54595b97b2d6ssdeep: 6144:lCjXsa7hE2B2UTQ3LYArOC82LBRZAWrn1JlSgsL:sTsa7hd4lYAiC82LBIWr1J8Ftype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Ransom.Atlas.1 also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 004fee311 )
Elastic	malicious (high confidence)
ALYac	Trojan.Ransom.Snocry
Malwarebytes	Malware.AI.1901226744
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Ransom.Atlas.1
K7GW	Trojan ( 004fee311 )
Cybereason	malicious.d77ff0
BitDefenderTheta	Gen:NN.ZexaF.34758.tqW@a4q!2Koi
Symantec	Trojan Horse
ESET-NOD32	Win32/Filecoder.CHIP.A
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.Snocry.dai
Alibaba	Ransom:Win32/Snocry.7645b32c
NANO-Antivirus	Trojan.Win32.Snocry.enuumn
MicroWorld-eScan	Gen:Variant.Ransom.Atlas.1
Tencent	Win32.Trojan.Snocry.Lmkf
Ad-Aware	Gen:Variant.Ransom.Atlas.1
TrendMicro	Ransom_CHIP.C
FireEye	Generic.mg.aa31d1ad77ff0431
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Snocry.ex
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1129379
AegisLab	Trojan.Win32.Snocry.j!c
GData	Win32.Trojan-Ransom.Atlas.A
AhnLab-V3	Win-Trojan/Sagecrypt.Gen
Acronis	suspicious
VBA32	Hoax.Snocry
MAX	malware (ai score=100)
TrendMicro-HouseCall	Ransom_CHIP.C
Rising	Trojan.Generic@ML.95 (RDML:ArA65/rDGty/frHDQPvK3g)
Yandex	Trojan.Snocry!EPp6gUse+58
Ikarus	Trojan.Win32.Filecoder
Fortinet	W32/Snocry.A!tr
Panda	Trj/CI.A