Ransom.StopcryptPMF.S24819168 (file analysis)

The Ransom.StopcryptPMF.S24819168 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.StopcryptPMF.S24819168 virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Ransom.StopcryptPMF.S24819168?


File Info:
name: 1F766254F4C1F4A0FFEB.mlw
path: /opt/CAPEv2/storage/binaries/4ff9e8ae5735720061353e56c0eb74988a8ad5a1dae7b0b049062fa27b779480
crc32: 7479A76A
md5: 1f766254f4c1f4a0ffebdae23cad7fa5
sha1: f4f2767913dc925bc646c55d55d09cc3f7973b71
sha256: 4ff9e8ae5735720061353e56c0eb74988a8ad5a1dae7b0b049062fa27b779480
sha512: 7a477d8b8e0dae7a688d620b5d98a92e7eec7f64a79f502ce3df6ce8007c6bd54718a045d4589eb28bf8e52d904e4ea813928d6d458f73e3aaf9b1927975b6a3
ssdeep: 6144:Cplt3FI5yRgjuAO7+lwgJ52XV3Mj/K6+jUSXWwl4/52:CpT3FIzSv763f2Gj/K6+ISXWwqx2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E424026416532437C05238B16A62E3B3176E4FF0556A69D2DB076238BF302E1F1FA77A
sha3_384: 54bc28f4a8e67c52b6b36efc5dc8f4e123f941ae16778c2647407d8330d9b57909636280d9e2e53d1fc8a8ff9e348ae2
ep_bytes: e86a310000e989feffff8bff558bec51
timestamp: 2021-03-22 06:16:20

Version Info:
0: [No Data]

Ransom.StopcryptPMF.S24819168 also known as:

Bkav	W32.AIDetect.malware1
DrWeb	Trojan.PWS.Stealer.26952
MicroWorld-eScan	Trojan.GenericKD.47462148
FireEye	Generic.mg.1f766254f4c1f4a0
CAT-QuickHeal	Ransom.StopcryptPMF.S24819168
ALYac	Trojan.GenericKD.47462148
Zillya	Trojan.Kryptik.Win32.3617938
Sangfor	Trojan.Win32.GenericKD.47462148
K7AntiVirus	Trojan ( 0058ac0c1 )
Alibaba	Ransom:Win32/StopCrypt.e02f18b9
K7GW	Trojan ( 0058ac0c1 )
Cybereason	malicious.913dc9
Symantec	Trojan.Gen.MBT
TrendMicro-HouseCall	Ransom_StopCrypt.R002C0TKM21
BitDefender	Trojan.GenericKD.47462148
Ad-Aware	Trojan.GenericKD.47462148
Sophos	Mal/Generic-S
TrendMicro	Ransom_StopCrypt.R002C0TKM21
McAfee-GW-Edition	Packed-GEE!1F766254F4C1
Emsisoft	Trojan.GenericKD.47462148 (B)
Ikarus	Trojan-Ransom.StopCrypt
GData	Win32.Trojan.BSE.11GYDBI
Jiangmin	Trojan.Chapak.pfc
eGambit	Unsafe.AI_Score_74%
MAX	malware (ai score=86)
Gridinsoft	Ransom.Win32.STOP.sa
Arcabit	Trojan.Generic.D2D43704
ViRobot	Trojan.Win32.Z.Stopcrypt.215040.A
Microsoft	Ransom:Win32/StopCrypt.PT!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Ransomware/Win.Stop.R452084
McAfee	Packed-GEE!1F766254F4C1
APEX	Malicious
Rising	Trojan.Kryptik!1.DAA2 (CLASSIC)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/PossibleThreat
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_60% (W)

How to remove Ransom.StopcryptPMF.S24819168?

Ransom.StopcryptPMF.S24819168 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X