Categories: Ransom

What is “Ransom.WhyCry”?

The Ransom.WhyCry is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.WhyCry virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
The binary likely contains encrypted or compressed data.
Exhibits possible ransomware file modification behavior
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Ransom.WhyCry?


File Info:
crc32: 2CB056F9md5: 434926139209f16dcab75d6239612dc3name: 434926139209F16DCAB75D6239612DC3.mlwsha1: 06a020e0868c7e93d6731f86eab48454f6a5de6dsha256: 0642b72510ddc99bb5565c481aee14b7df3e3d0d21b316a1792f9070765e38b0sha512: b3c00133f357c051307eab9c2f8b616126b1013593152eb07ac6506339652a56989e21c7c44287216dfaed895be7896e70b3faf7378de0556d34175533f7e252ssdeep: 6144:lITZm0tXr6QVXJlXsB4KuBC0+eekTdFyDPckajk:aw4X1VXJlX1vODPyktype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Tonec Inc., Copyright xa9 1999 - 2015InternalName: IDMGrHlpFileVersion: 6, 22, 1, 1CompanyName: Tonec Inc.LegalTrademarks: Internet Download ManagerComments: Auxiliary program for Internet Download ManagerProductName: Internet Download ManagerProductVersion: 6, 22, 1, 1FileDescription: Internet Download Manager moduleOriginalFilename: IDMGrHlp.EXETranslation: 0x0409 0x04b0

Ransom.WhyCry also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
ALYac	Trojan.Mint.Zamg.O
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 005340df1 )
K7AntiVirus	Trojan ( 005340df1 )
Cyren	W32/Trojan.BUF.gen!Eldorado
ESET-NOD32	a variant of Win32/Kryptik.GHPC
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.Crypmod.zyw
BitDefender	Trojan.Mint.Zamg.O
NANO-Antivirus	Trojan.Win32.Crypmod.felhqn
MicroWorld-eScan	Trojan.Mint.Zamg.O
Tencent	Win32.Trojan.Crypmod.Palt
Ad-Aware	Trojan.Mint.Zamg.O
Sophos	Mal/Generic-R + Mal/Hermes-C
Comodo	TrojWare.Win32.TrojanProxy.Bunitu.PC@803hth
BitDefenderTheta	Gen:NN.ZexaF.34790.oq1@aWvH8Jai
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom.Win32.SHADE.SMB.hp
McAfee-GW-Edition	GenericRXFV-NE!434926139209
FireEye	Generic.mg.434926139209f16d
Emsisoft	Trojan.Mint.Zamg.O (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1107201
eGambit	PE.Heur.InvalidSig
Antiy-AVL	Trojan/Generic.ASMalwS.26B48C6
Microsoft	Ransom:Win32/Wyhymyz.A
ZoneAlarm	HEUR:Trojan.Win32.NetStream.gen
GData	Trojan.Mint.Zamg.O
AhnLab-V3	Trojan/Win32.Hermesran.C2558008
Acronis	suspicious
McAfee	GenericRXFV-NE!434926139209
MAX	malware (ai score=96)
VBA32	BScope.TrojanRansom.Crypmod
Malwarebytes	Ransom.WhyCry
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom.Win32.SHADE.SMB.hp
Rising	Trojan.Generic@ML.90 (RDML:sCBJN9FHRRGEeBFRbt9sJw)
Yandex	Trojan.GenAsa!H/edbCjLmiM
Ikarus	Trojan.Win32.Injector
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.GWSH!tr
AVG	Win32:Malware-gen