Ransom.Zeppelin.29 malicious file

The Ransom.Zeppelin.29 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Zeppelin.29 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Rhaeto (Romance)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the shellcode get eip malware family
• Deletes executed files from disk
• Uses suspicious command line tools or Windows utilities
• Yara detections observed in process dumps, payloads or dropped files

How to determine Ransom.Zeppelin.29?

File Info:
name: 5673D38E23FC292A595E.mlw
path: /opt/CAPEv2/storage/binaries/16eb3c1becb1cadc6ceac24e81d8db4cd67c3f4dbccb7aedd4c174a678441c4a
crc32: 144275B6
md5: 5673d38e23fc292a595e37200e9fb90e
sha1: 7c563b8e891aeca0bf87dd9ab53c4436182ab3e0
sha256: 16eb3c1becb1cadc6ceac24e81d8db4cd67c3f4dbccb7aedd4c174a678441c4a
sha512: 5f3cc00b105c8919e497a8202bbbfc80a6c2f721ed83e7822c7bc74fbdd136e59586302de025267ef3f84c363159e7d541832ac68ab2bd5bc4d428b9d45159a7
ssdeep: 3072:6nMvhOb17UVJEwMn50Sf808YJIS0yLduB2ACHWKRw+6vGQhZ:OMw+VJEh0p5S0yo2A0W+MP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17504E0B27680C471CAA782354434CB602F7FB83516A5895F3B680AEE5F303D5A6B634F
sha3_384: 1d7ae6db83aa2e214dda4afbdec45050dc30f32587388bd9b695d66544b8da97afdd6f07a5caa6fa9091433eee451c90
ep_bytes: e8ee530000e978feffff8bff558bec83
timestamp: 2021-06-08 21:39:40

Version Info:
Translations: 0x0583 0x00ad

Ransom.Zeppelin.29 also known as:

How to remove Ransom.Zeppelin.29?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.