Ransom.BlackRuby information

The Ransom.BlackRuby is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.BlackRuby virus can do?

Executable code extraction
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Installs itself for autorun at Windows startup
Creates a hidden or system file
Unusual version info supplied for binary

Related domains:

freegeoip.net

github.com

How to determine Ransom.BlackRuby?


File Info:
crc32: 2CC272EE
md5: 7df8c61f053ed2c09741dd45acf922b4
name: 7DF8C61F053ED2C09741DD45ACF922B4.mlw
sha1: 6accc38be7fb264c24ff0b63940f990b1360844a
sha256: c625af92afe494e9373406a3f437ff6fea0b40158bc75cddca5b6e89202603d6
sha512: 729f7a54cd4e7f14c32cb22622f1786502d319eab26b102341c163ac2fab1b9bfa3542f31f7b045b37e35ad279b0b2358c5a1dccb989af4ce322a7433f5eaf22
ssdeep: 768:GpvZ5dLkTA3W0yLcroacjIm0rZz9KVViQrGrpJwtoGL06mi6zzrgCDxgiQhI6Is:668aLcDz/KVViOGkt0JoC1giOp
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 Microsoft all right reserved
Assembly Version: 4.10.19.120
InternalName: Windows Defender.exe
FileVersion: 4.10.19.120
CompanyName: 
LegalTrademarks: 
Comments: Microsoft Windows Defender Service
ProductName: Microsoft Windows Defender
ProductVersion: 4.10.19.120
FileDescription: Microsoft Windows Defender
OriginalFilename: Windows Defender.exe

Ransom.BlackRuby also known as:

K7AntiVirus	Trojan ( 005260861 )
Lionic	Trojan.Win32.Sysn.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.24772
Cynet	Malicious (score: 99)
ALYac	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
Cylance	Unsafe
Zillya	Dropper.Sysn.Win32.7361
Sangfor	Trojan.Win32.Save.a
Alibaba	Ransom:Win32/generic.ali2000010
K7GW	Trojan ( 005260861 )
Cybereason	malicious.f053ed
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Dropper.Win32.Sysn.cips
BitDefender	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
NANO-Antivirus	Trojan.Win32.Sysn.eymawt
MicroWorld-eScan	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
Tencent	Win32.Trojan.Raas.Auto
Ad-Aware	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
Sophos	Mal/Generic-S + Mal/Infitear-A
Comodo	Malware@#39auubd26olnh
BitDefenderTheta	Gen:NN.ZemsilF.34058.em0@aSsGqai
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Ransomware-GJQ!7DF8C61F053E
FireEye	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
Emsisoft	Trojan.Agent (A)
SentinelOne	Static AI – Suspicious PE
Jiangmin	TrojanDropper.Sysn.edt
Webroot	W32.Trojan.Gen
Avira	TR/FileCoder.dxckl
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan[Dropper]/Win32.Sysn
ZoneAlarm	Trojan-Dropper.Win32.Sysn.cips
Microsoft	Ransom:MSIL/Encruby
VBA32	TrojanDropper.Sysn
MAX	malware (ai score=98)
Malwarebytes	Ransom.BlackRuby
Panda	Trj/GdSda.A
Yandex	Trojan.DR.Sysn!fE1fzFZ83xQ
Ikarus	Trojan-Ransom.FileCrypter
Fortinet	MSIL/InfiniteTear.C!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/TrojanDropper.Sysn.HgIASQ0A

How to remove Ransom.BlackRuby?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Ransom.BlackRuby information