Ransom.Babuk.86 (B) malicious file

The Ransom.Babuk.86 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Babuk.86 (B) virus can do?

• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• CAPE detected the shellcode get eip malware family
• Deletes executed files from disk
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Ransom.Babuk.86 (B)?

File Info:
name: 5EAEDB1E4CE9F06430FB.mlw
path: /opt/CAPEv2/storage/binaries/b52860fd0a72144bdaca7361fb412783a04feef7907483654ad5e15960e2986b
crc32: FF993200
md5: 5eaedb1e4ce9f06430fbc12a46221c6d
sha1: aedd9ef361efe579676febd739e616f42ccd449d
sha256: b52860fd0a72144bdaca7361fb412783a04feef7907483654ad5e15960e2986b
sha512: bebf109570d672212db7978fd53fc1eed0ad74db6bdbdaa72f3856dd55f42a82c63b22de2f9dded3b4ac7dadcc20948e341378a0f85e1f4253ea9126463b3e1a
ssdeep: 6144:0G7p5xqNY8gf1r0ld6uryeeS4Iq/YgTkEjiPISUOgW9X+hOGzC/NM:l7hqNLgf1r0KCeWq/HTkmZzcukG2/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T171848D0AB7955723D19302B179FA85D05A3EFC60BBE283772858B24C3373BB456B6358
sha3_384: a234d9bff5b17b272736be2811b76ec7a57bd39de64b9ae526e4fb362c0798337ddcb7f5fc5e7bb041af5e5f2ecef832
ep_bytes: 60b99c3102008aa1ff0f400080ec5d80
timestamp: 2007-06-02 06:27:43

Version Info:
CompanyName: TODO: 
FileDescription: TODO: 
FileVersion: 1.0.0.1
InternalName: AdwTest.exe
LegalCopyright: TODO: (c) .  All rights reserved.
OriginalFilename: AdwTest.exe
ProductName: TODO: 
ProductVersion: 1.0.0.1
Translation: 0x0409 0x04e4

Ransom.Babuk.86 (B) also known as:

How to remove Ransom.Babuk.86 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.