About “Ransom.CryCipher” infection

The Ransom.CryCipher is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.CryCipher virus can do?

Anomalous binary characteristics

How to determine Ransom.CryCipher?


File Info:
crc32: A18F6EE3
md5: 3da0fd7121aea4adfb5de89651faf74c
name: 3DA0FD7121AEA4ADFB5DE89651FAF74C.mlw
sha1: be5df448635ef32e2ac3ab9f2ba8c0c39a79207c
sha256: 9514e5b58bce09004feefebb63724de1745b8c0f0f5705366303a8c8072b622d
sha512: 473cb02d634d9538fe17d8dc8a1d5b96441a0d5f6f2e79b4d6ee3a75a0cca9021bf2300424ebd3d50545729b2e6372c16a9b82aad978ad7284aaa781020d1bf3
ssdeep: 6144:HbK9spxES9TIY08tKwQ28oV0DATSpGRJYD8LP4kbBv0c7Q4xudE72lT:HbK9TpqhApUmSzh/1t
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Ransom.CryCipher also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 00116c681 )
Elastic	malicious (high confidence)
ClamAV	Win.Trojan.MSShellcode-6360728-0
ALYac	Gen:Variant.Ursu.385361
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
BitDefender	Gen:Variant.Ursu.385361
K7GW	Trojan ( 00116c681 )
Cybereason	malicious.121aea
ESET-NOD32	a variant of PowerShell/Filecoder.P
APEX	Malicious
Cynet	Malicious (score: 100)
NANO-Antivirus	Trojan.Win32.Swrort.eratya
ViRobot	Win32.Rozena.A
MicroWorld-eScan	Gen:Variant.Ursu.385361
Ad-Aware	Gen:Variant.Ursu.385361
BitDefenderTheta	Gen:NN.ZexaF.34628.u8W@ayC8CHb
FireEye	Generic.mg.3da0fd7121aea4ad
Emsisoft	Gen:Variant.Ursu.385361 (B)
Avira	TR/Crypt.XPACK.Gen
GData	Gen:Variant.Ursu.385361
AhnLab-V3	Win-Trojan/Swrort.X1746
Acronis	suspicious
VBA32	BScope.Trojan.Swrort
MAX	malware (ai score=82)
Malwarebytes	Ransom.CryCipher
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Generic.AP.23ADC0!tr
Qihoo-360	HEUR/QVM19.1.191B.Malware.Gen

How to remove Ransom.CryCipher?

Ransom.CryCipher removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X