Categories: Ransom

Should I remove “Ransom.TargetComp.S27214387”?

The Ransom.TargetComp.S27214387 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Ransom.TargetComp.S27214387 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • Manipulates data from or to the Recycle Bin
  • A process created a hidden window
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Attempts to delete or modify volume shadow copies
  • Writes a potential ransom message to disk
  • Modifies boot configuration settings
  • Uses suspicious command line tools or Windows utilities

How to determine Ransom.TargetComp.S27214387?


File Info:

name: 2ACB21C02B38DAD982D7.mlwpath: /opt/CAPEv2/storage/binaries/af723e236d982ceb9ca63521b80d3bee487319655c30285a078e8b529431c46ecrc32: 197DAB97md5: 2acb21c02b38dad982d78ebff7cfa2d3sha1: 75543627f8f2ab0c85228372a0eca6928ee84b7dsha256: af723e236d982ceb9ca63521b80d3bee487319655c30285a078e8b529431c46esha512: dfa53b2deff45b2b32cf8dcb346d42c8a5781e439103f5a4f537c78c681b865c8b71b804e8eedca70b1fe65582d0c40a0da3dc6a167c2a8396ec8f9080af28e2ssdeep: 3072:NvuCyuiR1nhKSPkZOWMLWBTxcoQivvz5l8E8h:NxytRbKZZOBLWBqoQkD8Etype: PE32 executable (console) Intel 80386, for MS Windowstlsh: T1D6D3AC2572E0C133E0A712309D74DBB12EBDB8316975D60BB788476E6E746C0CA363A3sha3_384: 03ac3e92f3746b6259c4710fd7e45ff65e4814efff2ae404f3d2f791b9559a8e375fa5eacdca33cd2b638e4f3a5d3e70ep_bytes: e832550000e9a5feffff8bff558bec81timestamp: 2021-12-04 23:47:57

Version Info:

0: [No Data]

Ransom.TargetComp.S27214387 also known as:

Lionic Trojan.Win32.Generic.j!c
CAT-QuickHeal Ransom.TargetComp.S27214387
McAfee GenericRXRE-KO!2ACB21C02B38
Malwarebytes Ransom.FileCryptor
Sangfor Trojan.Win32.Filecoder.OHO
K7AntiVirus Trojan ( 0057f18f1 )
Alibaba Ransom:Win32/generic.ali2000010
K7GW Trojan ( 0057f18f1 )
Cybereason malicious.02b38d
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Filecoder.OHO
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Ransom.Win32.Generic
BitDefender Gen:Heur.Ransom.REntS.Gen.1
MicroWorld-eScan Gen:Heur.Ransom.REntS.Gen.1
Avast FileRepMalware [Misc]
Rising Ransom.Outsider!1.D74B (CLOUD)
Ad-Aware Gen:Heur.Ransom.REntS.Gen.1
Emsisoft Gen:Heur.Ransom.REntS.Gen.1 (B)
DrWeb Trojan.Encoder.34933
Zillya Trojan.Filecoder.Win32.21285
TrendMicro Ransom.Win32.GARRANTDECRYPT.SM
McAfee-GW-Edition BehavesLike.Win32.Generic.ch
FireEye Generic.mg.2acb21c02b38dad9
Sophos Generic ML PUA (PUA)
Ikarus Trojan-Ransom.FileCrypter
GData Gen:Heur.Ransom.REntS.Gen.1
Jiangmin Trojan.Generic.hegkg
Webroot W32.Trojan.Gen
Avira TR/FileCoder.efijo
MAX malware (ai score=85)
Arcabit Trojan.Ransom.REntS.Gen.1
ZoneAlarm HEUR:Trojan-Ransom.Win32.Generic
Microsoft Ransom:Win32/GarrantDecrypt.PA!MTB
AhnLab-V3 Ransomware/Win.GarrantDecrypt.C4763520
VBA32 BScope.Trojan.DelShad
ALYac Trojan.Ransom.Filecoder
TACHYON Ransom/W32.Carone.132096
Cylance Unsafe
Tencent Win32.Trojan.Filecoder.Hugh
SentinelOne Static AI – Suspicious PE
MaxSecure Trojan.Malware.10307848.susgen
Fortinet W32/Filecoder.D181!tr.ransom
BitDefenderTheta Gen:NN.ZexaF.34638.iuW@a0S@Gedi
AVG FileRepMalware [Misc]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_100% (W)

How to remove Ransom.TargetComp.S27214387?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

What is “MSIL/TrojanDropper.Agent.BVT”?

The MSIL/TrojanDropper.Agent.BVT is considered dangerous by lots of security experts. When this infection is active,…

8 hours ago

Should I remove “Generic.Dacic.94CCEEA9.A.A4A6DA47”?

The Generic.Dacic.94CCEEA9.A.A4A6DA47 is considered dangerous by lots of security experts. When this infection is active,…

8 hours ago

Malware.AI.524217860 removal tips

The Malware.AI.524217860 is considered dangerous by lots of security experts. When this infection is active,…

8 hours ago

Trojan:Win32/Koutodoor.F removal tips

The Trojan:Win32/Koutodoor.F is considered dangerous by lots of security experts. When this infection is active,…

9 hours ago

How to remove “Malware.AI.1412460714”?

The Malware.AI.1412460714 is considered dangerous by lots of security experts. When this infection is active,…

9 hours ago

Generic.Dacic.8952383F.A.5EC8C34B removal instruction

The Generic.Dacic.8952383F.A.5EC8C34B is considered dangerous by lots of security experts. When this infection is active,…

9 hours ago