Categories: Ransom

Should I remove “Ransom.WannaCrypt.A4”?

The Ransom.WannaCrypt.A4 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.WannaCrypt.A4 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Authenticode signature is invalid
Attempts to modify desktop wallpaper

How to determine Ransom.WannaCrypt.A4?


File Info:
name: AA19446AB3172AD5BED3.mlwpath: /opt/CAPEv2/storage/binaries/d37c5455c68ad16cb73a0926d01acbfb5f917ac52aab237cc0eb614ae99ceba7crc32: 180DCE34md5: aa19446ab3172ad5bed3992fb55864dbsha1: a1d0f009b69cc7b603c6b56997eaa07a2f58a467sha256: d37c5455c68ad16cb73a0926d01acbfb5f917ac52aab237cc0eb614ae99ceba7sha512: 26a2b0609fd209964c8ac205e31d9bbb27b0b56ca2620b12dfab73c84d9bf732b0a6ac00373c07eec1fda6beb2b15048eefccca9b6c826bc78e9e6192c2db3c6ssdeep: 3072:Rmrhm1eigWcR+uiUg6p4FLlG4tlL3J+mmCeHFZxoHEo3m:REgIZiZhLlG4rQmmCatype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D034C56699D3916DF3DB25BC8000DB7CB8A76E1095321F3BB684F8EC18367E4CA6511Esha3_384: 1c1ee56cbb90b62dfd2427e017aa0da52217273ca7401e9f2e5cd3a07bf15de0a5275247194ffb7ce62ef4a705261469ep_bytes: 558bec6aff68a8ba4100685030410064timestamp: 2009-07-13 23:19:35
Version Info:
CompanyName: Microsoft CorporationFileDescription: Load PerfMon CountersFileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)InternalName: LODCTR.EXELegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: LODCTR.EXEProductName: Microsoft® Windows® Operating SystemProductVersion: 6.1.7600.16385Translation: 0x0409 0x04b0

Ransom.WannaCrypt.A4 also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Ransom.WannaCrypt.A4
ALYac	Trojan.Ransom.WannaCryptor.D
Malwarebytes	Ransom.WannaCrypt
VIPRE	Trojan.Win32.WannaCrypt.a (v)
K7AntiVirus	Trojan ( 00571a9e1 )
K7GW	Trojan ( 00571a9e1 )
Cybereason	malicious.ab3172
VirIT	Trojan.Win32.WannaCry.B
Cyren	W32/WannaCry.G.gen!Eldorado
Symantec	Ransom.Wannacry
ESET-NOD32	a variant of Win32/Filecoder.WannaCryptor.D
ClamAV	Win.Ransomware.WannaCry-6313787-0
Kaspersky	Trojan-Ransom.Win32.Wanna.c
BitDefender	Trojan.Ransom.WannaCryptor.D
NANO-Antivirus	Trojan.Win32.Wanna.eovgej
SUPERAntiSpyware	Trojan.Agent/Gen-Dropper
MicroWorld-eScan	Trojan.Ransom.WannaCryptor.D
Avast	Win32:WanaCry-A [Trj]
Tencent	Trojan.Win32.WannaCry.d
Emsisoft	Trojan.Ransom.WannaCryptor.D (B)
Comodo	TrojWare.Win32.Ransom.WannaCrypt.B@719b9h
DrWeb	Trojan.Encoder.11432
TrendMicro	Ransom_WCRY.SM
McAfee-GW-Edition	BehavesLike.Win32.Generic.dh
FireEye	Generic.mg.aa19446ab3172ad5
Sophos	ML/PE-A + Mal/Wanna-A
Jiangmin	Trojan.Wanna.ln
Avira	HEUR/AGEN.1118500
Antiy-AVL	Trojan/Generic.ASMalwS.2027829
Microsoft	Ransom:MSIL/Filecoder.PK!MSR
GData	Win32.Trojan-Ransom.WannaCry.E
AhnLab-V3	Trojan/Win32.WannaCryptor.R200589
McAfee	Ransom-WannaCry!AA19446AB317
TACHYON	Ransom/W32.Wanna.245760
VBA32	TrojanRansom.Wanna
TrendMicro-HouseCall	Ransom_WCRY.SM
Yandex	Trojan.GenAsa!DkX5FxEFGvQ
Ikarus	Trojan-Ransom.WannaCry
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/Wanna.C!tr.ransom
BitDefenderTheta	Gen:NN.ZexaF.34182.pq0@aOm@Elgi
AVG	Win32:WanaCry-A [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Trojan.Ransom.Wanna.d