Ransom.Ekati malicious file

The Ransom.Ekati is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.Ekati virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ransom.Ekati?


File Info:
crc32: 8AD80476
md5: 6ece4300cc5250ad1ba888d98e355590
name: 6ECE4300CC5250AD1BA888D98E355590.mlw
sha1: 615207b31cad07e33212339f02bc100f7e76f31b
sha256: b86ed1cec6c11f43db3a3c50bf223494e12d6c1499f6030e5f026526ebba49d5
sha512: 11fe743365f70690c5c7ef7bedf729597e30912e59996edb9bd7e33e2ae182c1c1b1c46d2c6971b17ecf647503eabc2efd481c5e9ee3b96211c8af193413afef
ssdeep: 384:jW4oceHkJPXtl7u4PxgujXmXa8bAJ92lQg21jZyF4PIfe3sZ:N3TRfumeubR8buzZyFzfhZ
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: 
Assembly Version: 1.0.0.0
InternalName: diamond.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: diamond
ProductVersion: 1.0.0.0
FileDescription: diamond
OriginalFilename: diamond.exe

Ransom.Ekati also known as:

Elastic	malicious (high confidence)
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_60% (D)
BitDefender	Gen:Variant.MSILPerseus.195992
Cybereason	malicious.0cc525
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Filecoder.UH
APEX	Malicious
Cynet	Malicious (score: 100)
MicroWorld-eScan	Gen:Variant.MSILPerseus.195992
Ad-Aware	Gen:Variant.MSILPerseus.195992
F-Secure	Heuristic.HEUR/AGEN.1130693
BitDefenderTheta	Gen:NN.ZemsilF.34758.bm1@ae8A6ep
FireEye	Generic.mg.6ece4300cc5250ad
Emsisoft	Gen:Variant.MSILPerseus.195992 (B)
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1130693
Microsoft	Program:Win32/Wacapew.C!ml
GData	Gen:Variant.MSILPerseus.195992
MAX	malware (ai score=81)
Malwarebytes	Ransom.Ekati
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Filecoder.UH!tr

How to remove Ransom.Ekati?

Ransom.Ekati removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X