Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Ransom
Threat report

Ransom.Phobos.154 (B) removal tips

Published Apr 22, 2024 Ransom category 3 min read
Report context

What to verify before removal

Ransom.Phobos.154 (B) removal tips should be handled as a recovery-sensitive report, not as a routine deletion task. Before removing files, isolate the affected system and compare the detection with the notes below so encrypted data, restore points, and backups are not damaged.

Start by comparing the local file name with 78E340D5E03BEF6D32E2.mlw, then review the behavior notes for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
78E340D5E03BEF6D32E2.mlw
  • Compare the suspicious file name with 78E340D5E03BEF6D32E2.mlw.
  • Confirm the detection name matches Ransom.Phobos.154 (B) removal tips before removing related files.
  • Review the report for file-encryption activity, ransom notes, renamed documents, and unexpected recovery blockers so the cleanup is based on observed behavior, not only the label.
  • Disconnect the machine from the network before recovery work and avoid deleting encrypted samples until backups are checked.

The Ransom.Phobos.154 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Ransom.Phobos.154 (B) virus can do?

  • Sample contains Overlay data
  • Reads data out of its own binary image
  • The binary contains an unknown PE section name indicative of packing
  • The executable is compressed using UPX
  • Authenticode signature is invalid

How to determine Ransom.Phobos.154 (B)?



File Info:

name: 78E340D5E03BEF6D32E2.mlw
path: /opt/CAPEv2/storage/binaries/20763aab685ee9599e1b9256014c158a248fba107f7389002b6ca76928de4a39
crc32: C555473C
md5: 78e340d5e03bef6d32e2d04414c2437b
sha1: c8cc356721b8ccc34f5363a5b3c53d95312b84a8
sha256: 20763aab685ee9599e1b9256014c158a248fba107f7389002b6ca76928de4a39
sha512: 928f4b648f713e042cca9393dfe81a8b75114b827c314df23da7f04415ce9eeec6fa4dd95855d551846885b4e346a9c113bd2346d242a1fc853f57693181b9a5
ssdeep: 3072:QmVW8iTX/3Rfl8Xq1+0cxxsWEL02fXcIp08Moe9DESZLUDKa0VFJk:JM7jJljxYTHYZM1vkKa0ru
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10094AE03B9A2E436E0D007B49E36FED8AA3774F11F746147BAEC6F0D2A74190953D686
sha3_384: 2727d52672d2990d770cc0ea0c86b76236ed5302d1a05889385200b22c857e69ca98ac391bbd36f8f0b8c051de97897d
ep_bytes: 558bec83c4e433c08945e88945ecb8d8
timestamp: 1996-07-28 22:22:17


Version Info:

0: [No Data]

Ransom.Phobos.154 (B) also known as:

Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
CAT-QuickHeal Worm.YoofIH.S26020738
Skyhigh BehavesLike.Win32.Backdoor.gz
ALYac Gen:Variant.Ransom.Phobos.154
Malwarebytes Generic.Malware.AI.DDS
Zillya Worm.Picsys.Win32.4
Sangfor Suspicious.Win32.Save.ins
K7AntiVirus Trojan ( 7000000f1 )
Alibaba Worm:Win32/Picsys.10056
K7GW Trojan ( 7000000f1 )
Arcabit Trojan.Ransom.Phobos.154
Baidu Win32.Worm.Picsys.a
VirIT Worm.Win32.PicSys.A
Symantec W32.HLLW.Yoof
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Picsys.D
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
ClamAV Win.Worm.Picsys-1
Kaspersky P2P-Worm.Win32.Picsys.c
BitDefender Gen:Variant.Ransom.Phobos.154
NANO-Antivirus Trojan.Win32.Sock4Proxy.jpdexe
MicroWorld-eScan Gen:Variant.Ransom.Phobos.154
Tencent Worm.Win32.Picsys.a
Emsisoft Gen:Variant.Ransom.Phobos.154 (B)
F-Secure Worm.WORM/Picsys.C.53
DrWeb Win32.HLLW.Morpheus.3
VIPRE Gen:Variant.Ransom.Phobos.154
TrendMicro TROJ_SPNR.30CU14
Trapmine malicious.high.ml.score
FireEye Generic.mg.78e340d5e03bef6d
Sophos W32/Picsys-C
Jiangmin Worm/Picsys.a
Webroot W32.Rogue.Gen
Google Detected
Avira WORM/Picsys.C.53
MAX malware (ai score=82)
Antiy-AVL Virus/Win32.Expiro.imp
Xcitium Packed.Win32.MUPX.Gen@24tbus
Microsoft Worm:Win32/Picsys.C
ZoneAlarm P2P-Worm.Win32.Picsys.c
GData Win32.Worm.Picsys.B
Varist W32/PicSys.A.gen!Eldorado
AhnLab-V3 Worm/Win.Picsys.C5398813
Acronis suspicious
McAfee W32/Picsys.worm!78E340D5E03B
TACHYON Worm/W32.Picsys
VBA32 Worm.Picsys
Cylance unsafe
Panda Trj/Genetic.gen
TrendMicro-HouseCall TROJ_SPNR.30CU14
Rising Worm.Picsys!1.C132 (CLASSIC)
Yandex Worm.P2P.Picsys!kNpPqZJwNbw
Ikarus Trojan.Win32.Ransom
MaxSecure Worm.W32.Picsys.C
Fortinet W32/Picsys.D!worm
BitDefenderTheta AI:Packer.05341F0B19
AVG Win32:TrojanX-gen [Trj]
DeepInstinct MALICIOUS
alibabacloud Worm:Win/Picsys

How to remove Ransom.Phobos.154 (B)?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.