Categories: Ransom

Ransom.GoRans (file analysis)

The Ransom.GoRans is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Ransom.GoRans virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid

How to determine Ransom.GoRans?


File Info:

name: 76284161AAF3A683C4CA.mlwpath: /opt/CAPEv2/storage/binaries/16c35ec9f66dda1341bb6b0f51b17604885eb35fc2d5ce38e0bc6e2ab3bb0ccdcrc32: 71C0D5EAmd5: 76284161aaf3a683c4ca5b393fc0f347sha1: 9dd64499de1036e338672e8958f3fe7199135796sha256: 16c35ec9f66dda1341bb6b0f51b17604885eb35fc2d5ce38e0bc6e2ab3bb0ccdsha512: 3798f453b161904ca23854f2808bb00d48d877a3317407c6c0489574dfa8b61ecf3dbc16643e311a508999383be3a838a753635f9adfb5d70fc45033c8573383ssdeep: 98304:J/zH0WzXZjYrL96HopzEcZ1cHcBY1qHIV6tkd0:ZzH0iqwqQyY10tkdtype: PE32 executable (console) Intel 80386, for MS Windowstlsh: T167563A50F9EB94F5DA03193014A7A2BF63307D058B29CBD7EA147F6AE877AD10D32219sha3_384: 5717e196822a8baaeddb95660232fa817144c704a11861df8e8150a1cc27b394f85007b5cb995b6e57e6edf5229bc589ep_bytes: e9dbdcffffcccccccccccccccccccccctimestamp: 1970-01-01 00:00:00

Version Info:

0: [No Data]

Ransom.GoRans also known as:

Lionic Trojan.Win32.ClipBanker.tscz
Elastic malicious (moderate confidence)
MicroWorld-eScan Trojan.GenericKD.64608917
FireEye Generic.mg.76284161aaf3a683
ALYac Trojan.Ransom.Filecoder
Cylance unsafe
Zillya Trojan.Filecoder.Win32.28144
Sangfor Trojan.Win32.Filecoder.Vgfr
Alibaba Trojan:Win32/Filecoder.eb5ecac2
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of WinGo/Filecoder.CO
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 99)
Kaspersky Trojan.Win32.Filecoder.ch
BitDefender Trojan.GenericKD.64608917
NANO-Antivirus Trojan.Win32.Filecoder.judbkt
Avast Win32:Trojan-gen
Tencent Win32.Trojan.Filecoder.Mjgl
Emsisoft Trojan.GenericKD.64608917 (B)
F-Secure Trojan.TR/FileCoder.zgxxg
VIPRE Trojan.GenericKD.64608917
McAfee-GW-Edition BehavesLike.Win32.Trojan.th
Sophos Mal/Generic-S
GData Trojan.GenericKD.64608917
Jiangmin Trojan.PSW.Stealer.byg
Avira TR/FileCoder.zgxxg
Antiy-AVL Trojan/Win32.Filecoder
Arcabit Trojan.Generic.D3D9DA95
ZoneAlarm Trojan.Win32.Filecoder.ch
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Trojan/Win.Trojan-gen.C5341885
McAfee Artemis!76284161AAF3
MAX malware (ai score=86)
Malwarebytes Ransom.GoRans
Panda Trj/RansomGen.A
TrendMicro-HouseCall TROJ_GEN.R002H0CLT22
Rising Trojan.Generic@AI.87 (RDML:yjxxv4AA/8ya1hjbYM0bJA)
Ikarus Trojan-Ransom.FileCrypter
Fortinet W32/Filecoder.CO!tr
AVG Win32:Trojan-gen
DeepInstinct MALICIOUS

How to remove Ransom.GoRans?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Share
Published by
Paul Valéry

Recent Posts

How to remove “Doina.50383”?

The Doina.50383 is considered dangerous by lots of security experts. When this infection is active,…

31 mins ago

Should I remove “Babar.207736”?

The Babar.207736 is considered dangerous by lots of security experts. When this infection is active,…

32 mins ago

Trojan.Heur.omSfrOVW61pj removal tips

The Trojan.Heur.omSfrOVW61pj is considered dangerous by lots of security experts. When this infection is active,…

42 mins ago

Win32/Kryptik.HDSJ information

The Win32/Kryptik.HDSJ is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago

MSIL/GameTool.U potentially unsafe removal

The MSIL/GameTool.U potentially unsafe is considered dangerous by lots of security experts. When this infection…

2 hours ago

Win32:VB-ABOX [Trj] removal guide

The Win32:VB-ABOX [Trj] is considered dangerous by lots of security experts. When this infection is…

2 hours ago