Categories: Ransom

Ransom.Azov.S28991174 removal

The Ransom.Azov.S28991174 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Azov.S28991174 virus can do?

Sample contains Overlay data
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Exhibits possible ransomware file modification behavior
Harvests cookies for information gathering
Anomalous binary characteristics
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Ransom.Azov.S28991174?


File Info:
name: 185E57A9920087AFF1CE.mlwpath: /opt/CAPEv2/storage/binaries/b593756b0d501a349b3dcf87e225f82ca5690e6404d4b344ebb9f928f6d4b693crc32: 3F8D9224md5: 185e57a9920087aff1ce66ea60874ab3sha1: a762bdda82824947456dfcf4429b35039d63f1d5sha256: b593756b0d501a349b3dcf87e225f82ca5690e6404d4b344ebb9f928f6d4b693sha512: 2624c7d73a9202aba1e093991a9a60d8367fc4b9c0020bad43751e5a84d4d6657df39d5bebfa9655e2f933265a05750092a20fb1d7e3a565c4a2196c13b341dfssdeep: 3072:rwQNU39K1Pb/DThJf6MymFB8rRcGr/yryIdXRWy4ZNC9GVImLsfWfW22f:r5s987TnfPymFBAq2aOpBZw9CTsfWfqftype: PE32+ executable (GUI) x86-64, for MS Windowstlsh: T13124381362A160E7D053B634B85FCB2F97657C6F07647B3E035C3F5A9E622809D29631sha3_384: d4caa6a9c7187897b477c428ad7985b70029769fba4fcb793d10b539151ecf5ae4f6d3c4b501d52466f306a2fee3b800ep_bytes: e848feffffc82000004c897c24f84883timestamp: 2018-03-15 13:15:18
Version Info:
Comments: http://www.autoitscript.com/autoit3/CompanyName: AutoIt TeamFileDescription: Au3InfoFileVersion: 3, 3, 14, 5InternalName: Au3Info.exeLegalCopyright: ©1999-2018 Jonathan Bennett & AutoIt TeamOriginalFilename: Au3Info.exeProductName: Au3InfoProductVersion: 3, 3, 14, 5Translation: 0x0809 0x04b0

Ransom.Azov.S28991174 also known as:

Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Variant.Cerbu.155261
FireEye	Generic.mg.185e57a9920087af
CAT-QuickHeal	Ransom.Azov.S28991174
VIPRE	Gen:Variant.Cerbu.155261
K7AntiVirus	Trojan ( 0059aa0b1 )
K7GW	Trojan ( 0059aa0b1 )
CrowdStrike	win/malicious_confidence_70% (D)
VirIT	Win64.AzovWiper.A
Cyren	W64/Ipamor.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win64/Filecoder.GG
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Ransom.Win32.Blocker.pef
BitDefender	Gen:Variant.Cerbu.155261
Ad-Aware	Gen:Variant.Cerbu.155261
Sophos	Troj/Azov-A
DrWeb	Win32.HLLP.Azov.2
TrendMicro	Ransom.Win64.AZVO.SMYXCJ5
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Cerbu.155261 (B)
Ikarus	Trojan-Ransom.FileCrypter
GData	Gen:Variant.Cerbu.155261
Jiangmin	Trojan.Blocker.urx
Antiy-AVL	GrayWare/Win32.Filecoder.gg
Arcabit	Trojan.Cerbu.D25E7D
Microsoft	Ransom:Win64/AzovCrypt.PA!MTB
Google	Detected
AhnLab-V3	Malware/Win.Ransom.R532483
ALYac	Gen:Variant.Cerbu.155261
MAX	malware (ai score=83)
Malwarebytes	Ransom.Azov
Rising	Ransom.Agent!8.6B7 (TFE:2:U9tOTBNOHOO)
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W64/Filecoder.GG!tr
Cybereason	malicious.992008