Ransom.VaultLock information

Malware Removal

The Ransom.VaultLock is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Ransom.VaultLock virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Injection with CreateRemoteThread in a remote process
  • Attempts to connect to a dead IP:Port (2 unique times)
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • Uses Windows utilities for basic functionality
  • Executed a process and injected code into it, probably while unpacking
  • Sniffs keystrokes
  • A system process is generating network traffic likely as a result of process injection
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics

Related domains:

nssdc.gsfc.nasa.gov

How to determine Ransom.VaultLock?


File Info:

crc32: B527ED1F
md5: c19f3b5e974da37c8a34e6e96635f61b
name: C19F3B5E974DA37C8A34E6E96635F61B.mlw
sha1: 31edb4b7a3637386d1e93f6eff0bd7c54ecbf907
sha256: 13292732b53fad2b788e90c276645cca57e6c2f05fef9d77e4e11d9959f0ef4b
sha512: e3123fb522bacb8a62691a155b6ec3799fb189e120870526df31c82a04b2018233d9a85530cf09899508439a71cf009a98ae56e785559a2ea5b4ce5e90edc14f
ssdeep: 6144:3376Slb6YkcTUE7sw/plC4IAujE+6WVppPsh+j3:33nJ6Y8chlC4IAujHOh63
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Ransom.VaultLock also known as:

K7AntiVirusTrojan ( 004db87e1 )
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Stealer.13052
CynetMalicious (score: 99)
ALYacTrojan.Dropper.YBB
CylanceUnsafe
ZillyaTrojan.Onion.Win32.2218
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
AlibabaRansom:Win32/Onion.aaa8ab34
K7GWTrojan ( 004db87e1 )
Cybereasonmalicious.e974da
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Injector.CZDC
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Trojan.Ursnif-9848875-1
KasperskyTrojan-Ransom.Win32.Onion.hh
BitDefenderTrojan.Dropper.YBB
NANO-AntivirusTrojan.Win32.Onion.evczct
MicroWorld-eScanTrojan.Dropper.YBB
TencentMalware.Win32.Gencirc.11494b36
Ad-AwareTrojan.Dropper.YBB
SophosMal/Generic-S
ComodoMalware@#27srfp89u03tl
BitDefenderThetaGen:NN.ZexaF.34058.rq3@aWkPbbob
VIPRETrojan.Win32.Injector.cdgy (v)
TrendMicroTROJ_TOBFY.SM1
McAfee-GW-EditionRansomware-FLS!C19F3B5E974D
FireEyeGeneric.mg.c19f3b5e974da37c
EmsisoftTrojan.Dropper.YBB (B)
JiangminTrojan.PSW.Fareit.esl
AviraHEUR/AGEN.1131060
eGambitUnsafe.AI_Score_100%
Antiy-AVLTrojan/Win32.TSGeneric
MicrosoftTrojanSpy:Win32/Ursnif
SUPERAntiSpywareRansom.VaultLock/Variant
GDataTrojan.Dropper.YBB
TACHYONRansom/W32.Onion.293890
AhnLab-V3Trojan/Win32.CryptoWall.R182092
McAfeeRansomware-FLS!C19F3B5E974D
MAXmalware (ai score=100)
VBA32Trojan-Ransom.Onion
MalwarebytesRansom.VaultLock
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_TOBFY.SM1
RisingTrojan.Generic@ML.100 (RDMK:Mgd/1GnqykreEYoP/3io4g)
YandexTrojan.GenAsa!iDmFuCB7Lio
IkarusTrojan.Win32.Injector
FortinetW32/Injector.CZBZ!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml
Qihoo-360Win32/Ransom.Generic.HwcBEpsA

How to remove Ransom.VaultLock?

Ransom.VaultLock removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment