Ransom.DarkyLock.2 malicious file

The Ransom.DarkyLock.2 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.DarkyLock.2 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Checks for the presence of known windows from debuggers and forensic tools
• CAPE detected the EnigmaStub malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Harvests cookies for information gathering
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Ransom.DarkyLock.2?

File Info:
name: 07A8BEF4A032F4A13DCA.mlw
path: /opt/CAPEv2/storage/binaries/b1a6c9dd9904aade48ba8118945264cd5ab399309333baa360fbf9fb7ab454b1
crc32: A846FAA5
md5: 07a8bef4a032f4a13dca0c78ce3d1c3d
sha1: f892092bbd9ede3d7a6f5576e9a2b7b327cf114c
sha256: b1a6c9dd9904aade48ba8118945264cd5ab399309333baa360fbf9fb7ab454b1
sha512: e69b879869ada13110fe67190d17fa2abaf5e801925d833482805f9f9b2dfa8396818b157fff11fda96262b198306fe305311cac85f0eb79f9b60c61d5e3cb78
ssdeep: 49152:Ku2YwK9I2LNyauUOPn/B5AnN/yrPFlfieFb+aFjSDEmI:L5fnNIUOPnDAN/kF5iez
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T163C533D19528C485CECD98BBF72ED62419A22F9A69D10067B1B27CC377BA2C0DB0D4DD
sha3_384: 166ea7716713567f27a6539932969075bb7e639e92f605e3061cd7f7ee4487590a5a03e5c4432f63dae22c6bac2f8d11
ep_bytes: eb08000e05000000000060e800000000
timestamp: 2011-07-03 09:05:04

Version Info:
CompanyName: The Enigma Protector Developers Team
FileDescription: Software Protection Tool
FileVersion: 1.0.7.13
InternalName: ENIGMA.EXE
LegalCopyright: Copyrights (C) 2002-2009 Vladimir Sukhov
LegalTrademarks: Trademarks (R) 2002-2009 Vladimir Sukhov
OriginalFilename: enigma.exe
ProductName: The Enigma Protector
ProductVersion: 1.0.0.0
Comments: http://enigmaprotector.com/
Translation: 0x0409 0x04b0

Ransom.DarkyLock.2 also known as:

How to remove Ransom.DarkyLock.2?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.