Categories: Ransom

Ransom.BlackRuby information

The Ransom.BlackRuby is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.BlackRuby virus can do?

Executable code extraction
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Installs itself for autorun at Windows startup
Creates a hidden or system file
Unusual version info supplied for binary

Related domains:

freegeoip.net

github.com

How to determine Ransom.BlackRuby?


File Info:
crc32: 2CC272EEmd5: 7df8c61f053ed2c09741dd45acf922b4name: 7DF8C61F053ED2C09741DD45ACF922B4.mlwsha1: 6accc38be7fb264c24ff0b63940f990b1360844asha256: c625af92afe494e9373406a3f437ff6fea0b40158bc75cddca5b6e89202603d6sha512: 729f7a54cd4e7f14c32cb22622f1786502d319eab26b102341c163ac2fab1b9bfa3542f31f7b045b37e35ad279b0b2358c5a1dccb989af4ce322a7433f5eaf22ssdeep: 768:GpvZ5dLkTA3W0yLcroacjIm0rZz9KVViQrGrpJwtoGL06mi6zzrgCDxgiQhI6Is:668aLcDz/KVViOGkt0JoC1giOptype: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Version Info:
Translation: 0x0000 0x04b0LegalCopyright: Copyright xa9 Microsoft all right reservedAssembly Version: 4.10.19.120InternalName: Windows Defender.exeFileVersion: 4.10.19.120CompanyName: LegalTrademarks: Comments: Microsoft Windows Defender ServiceProductName: Microsoft Windows DefenderProductVersion: 4.10.19.120FileDescription: Microsoft Windows DefenderOriginalFilename: Windows Defender.exe

Ransom.BlackRuby also known as:

K7AntiVirus	Trojan ( 005260861 )
Lionic	Trojan.Win32.Sysn.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.24772
Cynet	Malicious (score: 99)
ALYac	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
Cylance	Unsafe
Zillya	Dropper.Sysn.Win32.7361
Sangfor	Trojan.Win32.Save.a
Alibaba	Ransom:Win32/generic.ali2000010
K7GW	Trojan ( 005260861 )
Cybereason	malicious.f053ed
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Dropper.Win32.Sysn.cips
BitDefender	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
NANO-Antivirus	Trojan.Win32.Sysn.eymawt
MicroWorld-eScan	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
Tencent	Win32.Trojan.Raas.Auto
Ad-Aware	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
Sophos	Mal/Generic-S + Mal/Infitear-A
Comodo	Malware@#39auubd26olnh
BitDefenderTheta	Gen:NN.ZemsilF.34058.em0@aSsGqai
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Ransomware-GJQ!7DF8C61F053E
FireEye	DeepScan:Generic.Ransom.Hiddentear.A.D078EDE2
Emsisoft	Trojan.Agent (A)
SentinelOne	Static AI – Suspicious PE
Jiangmin	TrojanDropper.Sysn.edt
Webroot	W32.Trojan.Gen
Avira	TR/FileCoder.dxckl
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan[Dropper]/Win32.Sysn
ZoneAlarm	Trojan-Dropper.Win32.Sysn.cips
Microsoft	Ransom:MSIL/Encruby
VBA32	TrojanDropper.Sysn
MAX	malware (ai score=98)
Malwarebytes	Ransom.BlackRuby
Panda	Trj/GdSda.A
Yandex	Trojan.DR.Sysn!fE1fzFZ83xQ
Ikarus	Trojan-Ransom.FileCrypter
Fortinet	MSIL/InfiniteTear.C!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/TrojanDropper.Sysn.HgIASQ0A