Ransom.Unlock92.18 (file analysis)

The Ransom.Unlock92.18 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Unlock92.18 virus can do?

Creates RWX memory
A process created a hidden window
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Ransom.Unlock92.18?


File Info:
crc32: 556D3A7C
md5: 21b63b084472a53132eda85aa1b1b4b3
name: 21B63B084472A53132EDA85AA1B1B4B3.mlw
sha1: 10e9c24142500ae4401275d4a1f32addab7a741e
sha256: badc0ee0f7e7f38b671a14c9a1ad365f9195bbf17275092edea508902337e406
sha512: f4a3bd3fc1a82ccf18fd3f2cb067bd245b6428b63e6339918fb3dc5238d4418f607a4b83619922b67096422c9c578d50d2b200d98bc857851b1224fbae2c100f
ssdeep: 768:/agPg/6pnvQz/QmQDSitsde8LB7ettsfk1gbpeCmGFYJUe886UKM0T5QCkuf:d9Oz/HpBgtsFNeCmif86fMq+ruf
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2018
Assembly Version: 1.0.0.0
InternalName: Gatadana.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: Gatadana
ProductVersion: 1.0.0.0
FileDescription: Gatadana
OriginalFilename: Gatadana.exe

Ransom.Unlock92.18 also known as:

K7AntiVirus	Trojan ( 004d443e1 )
Lionic	Trojan.MSIL.Geograph.j!c
DrWeb	Trojan.MulDrop8.3041
ALYac	Gen:Variant.Ransom.Unlock92.18
Cylance	Unsafe
Zillya	Trojan.Generic.Win32.295956
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (D)
K7GW	Trojan ( 004d443e1 )
Cybereason	malicious.84472a
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Filecoder.AC
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Cynet	Malicious (score: 99)
Kaspersky	Trojan-Ransom.MSIL.Geograph.dj
BitDefender	Gen:Variant.Ransom.Unlock92.18
NANO-Antivirus	Trojan.Win32.Ransom.ezcyxa
MicroWorld-eScan	Gen:Variant.Ransom.Unlock92.18
Tencent	Win32.Trojan.Raas.Auto
Ad-Aware	Gen:Variant.Ransom.Unlock92.18
Sophos	Mal/Generic-S + Mal/CrypZxas-A
Comodo	Malware@#2ms1x2olhqnuw
BitDefenderTheta	Gen:NN.ZemsilF.34796.dm0@a4TK4Qc
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.qc
FireEye	Generic.mg.21b63b084472a531
Emsisoft	Gen:Variant.Ransom.Unlock92.18 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.MSIL.kmub
Avira	HEUR/AGEN.1115170
eGambit	Unsafe.AI_Score_99%
Microsoft	Ransom:Win32/Genasom
GData	Gen:Variant.Ransom.Unlock92.18
McAfee	Generic.dqr
MAX	malware (ai score=94)
VBA32	TrojanRansom.MSIL.Geograph
Malwarebytes	Ransom.FileCryptor
Panda	Trj/GdSda.A
Ikarus	Trojan-Ransom.FileCrypter
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Filecoder.AC!tr
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml

How to remove Ransom.Unlock92.18?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Ransom.Unlock92.18 (file analysis)