Ransom.HydraCrypt.1 (file analysis)

The Ransom.HydraCrypt.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.HydraCrypt.1 virus can do?

The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

How to determine Ransom.HydraCrypt.1?


File Info:
crc32: FC0D775E
md5: ac6d3c5c0c4ac6c8649b3aac03b756d9
name: AC6D3C5C0C4AC6C8649B3AAC03B756D9.mlw
sha1: a5be314a777a61f7d0eed84b15d5ef25fe2c4676
sha256: 8d6d88321dbd629e5b2fbcd69e0bf4d0c19f916fc850f3ba3baca5873bc6bfb2
sha512: 97d5428995b6ca1d10a84eb5eda02873675962a52992f93b5d2477cd9e5a0e42edb807f960d2f30e28ba60940fbc807910dc7ea8097275cd36e6b77f1f86c2c0
ssdeep: 3072:tMhjrCs7VYMJfNgLVmsqoJ0bnLQyWrHGloFoaIl+pcdZv73eD4i0cavrJS4cVa6:tMhuMJFuTQnkyWrmWRIUc2D4iekN
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright 1995 - 2005
FileVersion: 1,14,10,4
CompanyName: SynSoft, Corporation.
ProductName: YsdTwabl
ProductVersion: 1,14,10,4
FileDescription: pWiGwkR
OriginalFilename: aQLhsGlYcMim.exe
Translation: 0x0410 0x04b0

Ransom.HydraCrypt.1 also known as:

Bkav	W32.AIDetect.malware1
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ransom.HydraCrypt.1
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/EncPk.46805e00
K7GW	Trojan ( 0051f8a21 )
K7AntiVirus	Trojan ( 0051f8a21 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.KIOCVBV
APEX	Malicious
Avast	Win32:Malware-gen
BitDefender	Gen:Variant.Ransom.HydraCrypt.1
MicroWorld-eScan	Gen:Variant.Ransom.HydraCrypt.1
Tencent	Win32.Trojan.Crypt.Lohx
Ad-Aware	Gen:Variant.Ransom.HydraCrypt.1
Sophos	Mal/Generic-R + Mal/EncPk-ALY
Comodo	Malware@#351o87jb7vgoy
BitDefenderTheta	AI:Packer.9333E7A221
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
FireEye	Generic.mg.ac6d3c5c0c4ac6c8
Emsisoft	Gen:Variant.Ransom.HydraCrypt.1 (B)
Avira	TR/Crypt.ZPACK.imrvo
Antiy-AVL	Trojan/Win32.BTSGeneric
Microsoft	Trojan:Win32/Tiggre!rfn
Arcabit	Trojan.Ransom.HydraCrypt.1
AegisLab	Trojan.Win32.HydraCrypt.4!c
GData	Gen:Variant.Ransom.HydraCrypt.1
AhnLab-V3	Malware/Win32.Generic.C2369280
Acronis	suspicious
McAfee	Artemis!AC6D3C5C0C4A
MAX	malware (ai score=100)
VBA32	Malware-Cryptor.General.3
Malwarebytes	Malware.Heuristic.1003
Rising	Trojan.Crypto!8.364 (CLOUD)
Yandex	Trojan.Agent!ba7hJ7hdQD8
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.10445116.susgen
Fortinet	PossibleThreat
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.Generic.HgIASOoA

How to remove Ransom.HydraCrypt.1?

Ransom.HydraCrypt.1 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X