Ransom.Babuk.86 (B) malicious file

The Ransom.Babuk.86 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Babuk.86 (B) virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Deletes executed files from disk
• Anomalous binary characteristics

How to determine Ransom.Babuk.86 (B)?

File Info:
name: 3740470DE223423A2087.mlw
path: /opt/CAPEv2/storage/binaries/1675ff37dd2485c5da757404421ed8e8ebe414ea32c3c492439723c1476a18c3
crc32: 7855495A
md5: 3740470de223423a2087339ea64e01dd
sha1: fd39944c3d305b1777deb5d5906a868cab749885
sha256: 1675ff37dd2485c5da757404421ed8e8ebe414ea32c3c492439723c1476a18c3
sha512: 9f24bde8daa4d18c6a34b28cc7e85848518aef3ee9389b58ceef9bf46a155724447ca1e45f6e4ec38e370883f1fafb68e708d350592147977720e143cbba1bf1
ssdeep: 6144:MGtxZC0JLsvWo0Gu8x0Lv2ikEjiPISUOgW9X+hOGzC/NM:Mh4sWL8qkmZzcukG2/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14BA46D59FF548B13E2570235E8A5E4A0D7B67C91F39DC2173458B36C2273B900A7EBA8
sha3_384: 47e1b3cdd03942efc6451e727e233fab703a26a8ebaa0125d691bda9225e71e22e755e246d3cd01937014ef5ee94da61
ep_bytes: 60bf000000008a870010400080e8c580
timestamp: 2007-06-02 06:27:43

Version Info:
CompanyName: TODO: 
FileDescription: TODO: 
FileVersion: 1.0.0.1
InternalName: AdwTest.exe
LegalCopyright: TODO: (c) .  All rights reserved.
OriginalFilename: AdwTest.exe
ProductName: TODO: 
ProductVersion: 1.0.0.1
Translation: 0x0409 0x04e4

Ransom.Babuk.86 (B) also known as:

How to remove Ransom.Babuk.86 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.