How to remove “Ransom.Prometheus.2”?

The Ransom.Prometheus.2 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.Prometheus.2 virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Ransom.Prometheus.2?


File Info:
name: 890302EF1B8EE49C9205.mlw
path: /opt/CAPEv2/storage/binaries/a88200aa5c62d7d377cda257000aee2b0482a82618cbf31bff29c758443f00a1
crc32: 71039D2F
md5: 890302ef1b8ee49c9205a8afb1f058aa
sha1: cdc230f93f916ce481f242b030440a7b416ad5d8
sha256: a88200aa5c62d7d377cda257000aee2b0482a82618cbf31bff29c758443f00a1
sha512: 1719bb33a024eea91d68aa0c788884a720aeb0b1342ac534efb501724336637649880bb2d264dc6a3b8373d7fe5d3e43916302c0d648d74bd505914550854679
ssdeep: 24576:xrBWuz7tQUlH0lTtQD9DzU9Yz8Do3wikAHjQv6v35JThG57:xtWuz0++oCAHBv3510
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T151557C027E44CE21F01D1633C2EF454887B0A95166A6E32B7DBE37AE59123973D0D9EB
sha3_384: aa18d8393106ac26ebe69534079d5ab3efa000cb125a432e2d1747ee769da456d0e938fcc92c101d058089bf449e2fe0
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-05-04 16:03:35

Version Info:
FileVersion: 5.15.2.0
OriginalFilename: libGLESv2.dll
ProductName: libGLESv2
ProductVersion: 5.15.2.0
Translation: 0x0409 0x04b0

Ransom.Prometheus.2 also known as:

Bkav	W32.AIDetectMalware.CS
tehtris	Generic.Malware
DrWeb	Trojan.PWS.StealerNET.124
MicroWorld-eScan	Gen:Variant.Ransom.Prometheus.2
ClamAV	Win.Packed.Msilmamut-9950860-0
FireEye	Generic.mg.890302ef1b8ee49c
CAT-QuickHeal	Trojan.DCRat.S29707587
Skyhigh	BehavesLike.Win32.Generic.tc
McAfee	Trojan-FUJL!890302EF1B8E
Malwarebytes	Generic.Spyware.Stealer.DDS
VIPRE	Gen:Variant.Ransom.Prometheus.2
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Spyware ( 0058ebd51 )
K7GW	Spyware ( 0058ebd51 )
CrowdStrike	win/malicious_confidence_100% (D)
BitDefenderTheta	Gen:NN.ZemsilF.36744.tr0@a4QjRLbi
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Spy.Agent.DTP
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.DCRat.gen
BitDefender	Gen:Variant.Ransom.Prometheus.2
Avast	Win32:CrypterX-gen [Trj]
Emsisoft	Gen:Variant.Ransom.Prometheus.2 (B)
F-Secure	Heuristic.HEUR/AGEN.1323984
Zillya	Trojan.BasicGen.Win32.4
Sophos	Troj/DCRat-N
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Ransom.Prometheus.2
Google	Detected
Avira	HEUR/AGEN.1323984
MAX	malware (ai score=88)
Kingsoft	malware.kb.c.996
Arcabit	Trojan.Ransom.Prometheus.2
ZoneAlarm	HEUR:Backdoor.MSIL.DCRat.gen
Microsoft	Backdoor:MSIL/DCRat!MTB
Varist	W32/MSIL_Agent.LQ.gen!Eldorado
AhnLab-V3	Trojan/Win.FUJL.C5119684
Acronis	suspicious
ALYac	Gen:Variant.Ransom.Prometheus.2
Cylance	unsafe
Tencent	Trojan.Msil.Dcrat.xa
Ikarus	Trojan.MSIL.Injector
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Agent.DVA!tr
AVG	Win32:CrypterX-gen [Trj]
Cybereason	malicious.93f916
DeepInstinct	MALICIOUS

How to remove Ransom.Prometheus.2?

Ransom.Prometheus.2 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X