How to remove “Ransom.Prometheus.1”?

The Ransom.Prometheus.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.Prometheus.1 virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Ransom.Prometheus.1?


File Info:
name: BEF76F49F24A18AF0EA3.mlw
path: /opt/CAPEv2/storage/binaries/f0dc9d160847780432c8311f4bd804bd85eac7169d628891759a2f63c6266c5c
crc32: 7A78617C
md5: bef76f49f24a18af0ea380e3fd86bc5b
sha1: 772a8e1223331a0a66705e9b2a397f54aad1e710
sha256: f0dc9d160847780432c8311f4bd804bd85eac7169d628891759a2f63c6266c5c
sha512: dab825a10bcfaa4c9b53d3ff2359c9168d04d1c968bf17458ad0667ca04e59b9952b6f115f43a902228d3a948e590e660a2c02adb7e4708e8d21545d3511d100
ssdeep: 49152:tKHhSFUV2OFvdds4muR74LtvSZ/r2fdPOd8Rimmch+ZL0:AHhSKVBV4Rva2VQ80mHE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T137C5CF027E448E41F4181377C2EF464887B0AD916AA6E31B7CBA736E58123A77D4DDCB
sha3_384: 50a5ecb3ab5abff0383850c89348d99e7f3ee093779cd6d8e53b6e6318eb4b5166f1ae3b30c8a99efeb3ff7f6a587e1d
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-05-04 16:03:35

Version Info:
FileVersion: 5.15.2.0
OriginalFilename: libGLESv2.dll
ProductName: libGLESv2
ProductVersion: 5.15.2.0
Translation: 0x0409 0x04b0

Ransom.Prometheus.1 also known as:

Bkav	W32.AIDetectMalware.CS
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Ransom.Prometheus.1
FireEye	Generic.mg.bef76f49f24a18af
CAT-QuickHeal	Trojan.DCRat.S29707587
Skyhigh	BehavesLike.Win32.Generic.vc
McAfee	Trojan-FUJL!BEF76F49F24A
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Spyware ( 0058ebd51 )
K7AntiVirus	Spyware ( 0058ebd51 )
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Spy.Agent.DTP
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.DCRat.gen
BitDefender	Gen:Variant.Ransom.Prometheus.1
Avast	Win32:CrypterX-gen [Trj]
Tencent	Trojan.Msil.Dcrat.xa
Emsisoft	Gen:Variant.Ransom.Prometheus.1 (B)
F-Secure	Heuristic.HEUR/AGEN.1323984
DrWeb	Trojan.PWS.StealerNET.124
VIPRE	Gen:Variant.Ransom.Prometheus.1
Sophos	Troj/DCRat-N
Ikarus	Trojan.MSIL.Injector
Google	Detected
Avira	HEUR/AGEN.1323984
Kingsoft	malware.kb.c.978
Arcabit	Trojan.Ransom.Prometheus.1
ZoneAlarm	HEUR:Backdoor.MSIL.DCRat.gen
GData	Gen:Variant.Ransom.Prometheus.1
Varist	W32/MSIL_Agent.LQ.gen!Eldorado
AhnLab-V3	Trojan/Win.FUJL.C5119684
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.36744.Gs0@aeNUP3gi
ALYac	Gen:Variant.Ransom.Prometheus.1
MAX	malware (ai score=84)
Malwarebytes	Generic.Spyware.Stealer.DDS
Rising	Backdoor.DCRat!8.129D9 (TFE:dGZlOg17w21gZmgvxA)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.DVA!tr
AVG	Win32:CrypterX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Ransom.Prometheus.1?

Ransom.Prometheus.1 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X