Ransom.Generic.3 (file analysis)

Malware Removal

The Ransom.Generic.3 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Review

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Ransom.Generic.3 virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Looks up the external IP address
  • Executed a process and injected code into it, probably while unpacking
  • Sniffs keystrokes
  • Attempts to remove evidence of file being downloaded from the Internet
  • A process attempted to delay the analysis task by a long amount of time.
  • Steals private information from local Internet browsers
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Creates a copy of itself
  • Harvests credentials from local FTP client softwares
  • Harvests information related to installed instant messenger clients
  • Harvests information related to installed mail clients
  • Collects information to fingerprint the system

Related domains:

z.whorecord.xyz
a.tomx.xyz
checkip.dyndns.org
airnicoltd.biz

How to determine Ransom.Generic.3?


File Info:

crc32: 3402F88C
md5: 198cd80e37da0dbbaf969749e7ea1f9c
name: swift.scr
sha1: d6e5dcad5b0ceae5db56d62750554d69e9c569b2
sha256: 2fe7660d58b881541c1f929382f478d19f17fdb56f2e8b313b8cfc0545a615bd
sha512: f5d509e4ee75878f079109e4b8a056f850b67587b92e6d088e66bd79c05fdedaafb379b00d6e950bd7ab9f129351ec7be0aa911c5722254b2ea6e7eb3fc02b9d
ssdeep: 3072:4lNZI9tfF+mtm4VOG4BXvYLQsuC4psGMLmKdTX5kMsOxylt:6gtt+352u1SL
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:

Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 Microsoft 2013
Assembly Version: 7.8.11.14
InternalName: swift.exe
FileVersion: 16.16.13.15
CompanyName: Microsoft
Comments: Koler Decoer
ProductName: Koler
ProductVersion: 16.16.13.15
FileDescription: Koler
OriginalFilename: swift.exe

Ransom.Generic.3 also known as:

MicroWorld-eScanGen:Variant.Ransom.Generic.3
McAfeeTrojan-FNSD!198CD80E37DA
CylanceUnsafe
TencentWin32.Backdoor.Generic.Dzkm
BaiduWin32.Trojan.WisdomEyes.16070401.9500.9983
F-ProtW32/MSIL_Injector.LC.gen!Eldorado
SymantecML.Attribute.HighConfidence
GDataGen:Variant.Ransom.Generic.3
KasperskyHEUR:Backdoor.WIN32.Generic
BitDefenderGen:Variant.Ransom.Generic.3
Endgamemalicious (high confidence)
EmsisoftGen:Variant.Ransom.Generic.3 (B)
F-SecureGen:Variant.Ransom.Generic.3
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Trojan.ch
CyrenW32/MSIL_Injector.LC.gen!Eldorado
ArcabitTrojan.Ransom.Generic.3
AegisLabTroj.W32.Gen.m48a
ZoneAlarmHEUR:Backdoor.WIN32.Generic
ALYacGen:Variant.Ransom.Generic.3
MAXmalware (ai score=98)
Ad-AwareGen:Variant.Ransom.Generic.3
ESET-NOD32a variant of MSIL/Injector.SRE
RisingBackdoor.Generic!8.CE (cloud:WiqUCkXI8eS)
SentinelOnestatic engine – malicious
FortinetMSIL/Injector.SRE!tr
CrowdStrikemalicious_confidence_100% (D)
Qihoo-360HEUR/QVM03.0.E626.Malware.Gen

How to remove Ransom.Generic.3?

Ransom.Generic.3 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment