Ransom.StopcryptRI.S26261809 removal tips

The Ransom.StopcryptRI.S26261809 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.StopcryptRI.S26261809 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Hongkong)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Enumerates services, possibly for anti-virtualization
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the Tofsee malware family
• Attempts to interact with an Alternate Data Stream (ADS)
• Uses suspicious command line tools or Windows utilities

How to determine Ransom.StopcryptRI.S26261809?

File Info:
name: 63EE517D123CC3F6060D.mlw
path: /opt/CAPEv2/storage/binaries/963a1bb8e816be9b694607bea9e1d14833fb2b88f122736de4ab280e44141183
crc32: 33EC4AE6
md5: 63ee517d123cc3f6060d27337c682b6e
sha1: 8fddb0b692fae9067d0cafc4193f25564b148a13
sha256: 963a1bb8e816be9b694607bea9e1d14833fb2b88f122736de4ab280e44141183
sha512: 75fb1bff6596c72ae0138b96950cb5f2090eddbd1059458799b0d07119c2b00101b7d3adb78173f8233fffc69c318c0a90f4b3469db5928721de0b335aa5183f
ssdeep: 6144:y1Ubgj8sazivC/162UpaDhAqnQep3tjQTk51d5BqQynF:ymm8s1K962UpaSqn/pQg5D5kV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D0549E10B7A0D035E1B712F8497A97ACB93E7AF15B3490CB52D12ADE1A396E1DC3131B
sha3_384: 61de607d70c6458df6aa7d480820f5909d6ce84d52c3d34981b75a8c9d5dac8d95cb2c7561cd75c54aa01fb39f11120a
ep_bytes: 8bff558bece836730000e8110000005d
timestamp: 2021-06-20 13:08:04

Version Info:
0: [No Data]

Ransom.StopcryptRI.S26261809 also known as:

How to remove Ransom.StopcryptRI.S26261809?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.