What is “Ransom.DarkSide.Decryptor”?

The Ransom.DarkSide.Decryptor is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.DarkSide.Decryptor virus can do?

Network activity detected but not expressed in API logs
Collects information to fingerprint the system
Anomalous binary characteristics

How to determine Ransom.DarkSide.Decryptor?


File Info:
crc32: BC54A816
md5: fb44e27b8b74a1fcba1f67259dbab614
name: FB44E27B8B74A1FCBA1F67259DBAB614.mlw
sha1: 53e4c834030ce833df7a92929fa3745e3ccc35d8
sha256: c30aa07e6d1c42cf8d86f151f1ec08fb6090e78600ba8cd69076d988c49901df
sha512: 8b86be82907b0d474d2fc13443349e31e4ae54616283b3b681cc0f4952ef014b6f11777dfac50f5c4789972005bbada550ba608668ffa8e16158f56304cc8cc2
ssdeep: 768:9I0b0vVtmRhFvHuLt59Jurq8gv3pQH/JYc+8WlXkHSH:DbiVuvHuBkrqzvZaqXk
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Ransom.DarkSide.Decryptor also known as:

K7AntiVirus	Riskware ( 0040eff71 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Razy.866185
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7GW	Riskware ( 0040eff71 )
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Win32.Gen.aayq
BitDefender	Gen:Variant.Razy.866185
MicroWorld-eScan	Gen:Variant.Razy.866185
Ad-Aware	Gen:Variant.Razy.866185
Sophos	ML/PE-A
F-Secure	Heuristic.HEUR/AGEN.1120890
BitDefenderTheta	Gen:NN.ZexaF.34686.fqW@aWPh!ahi
McAfee-GW-Edition	BehavesLike.Win32.Generic.mt
FireEye	Generic.mg.fb44e27b8b74a1fc
Emsisoft	Gen:Variant.Razy.866185 (B)
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1120890
Arcabit	Trojan.Razy.DD3789
GData	Gen:Variant.Razy.866185
MAX	malware (ai score=81)
Malwarebytes	Ransom.DarkSide.Decryptor
Rising	Malware.Heuristic!ET#78% (RDMK:cmRtazo6ChyXYAZyCCDWURO807+m)
AVG	Win32:Malware-gen

How to remove Ransom.DarkSide.Decryptor?

Ransom.DarkSide.Decryptor removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X