Ransom

What is “Ransom:Linux/Filecoder.R!MTB”?

Malware Removal

The Ransom:Linux/Filecoder.R!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom:Linux/Filecoder.R!MTB virus can do?

  • Sample contains Overlay data
  • Unconventionial language used in binary resources: Turkish
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Ransom:Linux/Filecoder.R!MTB?



File Info:

name: FE7543086E93BF213174.mlw
path: /opt/CAPEv2/storage/binaries/90eead385ee96ac7c5ca743a031ec52ae71dc11ac3a12b3909f16c9cac0e8d68
crc32: 32A036B3
md5: fe7543086e93bf2131745d799273e2ea
sha1: e9ba7f75be8a492858cead0f6558fd24391e90cb
sha256: 90eead385ee96ac7c5ca743a031ec52ae71dc11ac3a12b3909f16c9cac0e8d68
sha512: 73f2e4587de01a349a941279dd98e880c41d23b2c5c92f7bc318877b18f29908032b878c04afc37a66c9842ab22998687b24e156717cc75d5081c30ce22be6e1
ssdeep: 6144:kR/bxfWNuX1Ed5hZ9UxhX4O498sfti2QBm1vNc6i:kRzxUuedXrQ4984HQB6Nc6i
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10E241224CAE29D21F65743FA23343D3463F62F206B4514DBAE9E7FB892B07960406637
sha3_384: 95a6bff1dd980322548f0b166531aa913f9bcee811e5a3d0c4ed1ad1fc7506d7a769a6fcca84f36eb907f9bf324f5f22
ep_bytes: 55e91f3505000000006ac76a216800f8
timestamp: 2011-10-02 06:40:09


Version Info:

CompanyName: BitMefender S.R.L.
FileDescription: BitMefender Antivirus Scanner
FileVersion: 13,0,21,1
InternalName: GUIScanner
LegalCopyright: Copyright (C) 2010
OriginalFilename: uiscan.exe
ProductName: BitMefender 2016
ProductVersion: 13,0,18,344
Translation: 0x0409 0x04b0

Ransom:Linux/Filecoder.R!MTB also known as:

BkavW32.AIDetectMalware
LionicTrojan.Win32.Generic.4!c
MicroWorld-eScanGeneric.Dacic.A82088AB.A.6888F051
ClamAVWin.Trojan.Yakes-1870
FireEyeGeneric.mg.fe7543086e93bf21
CAT-QuickHealTrojan.Zbot
McAfeeGenericRXWD-RE!FE7543086E93
MalwarebytesGeneric.Malware.AI.DDS
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 005a60f61 )
AlibabaMalware:Win32/km_2eb30.None
K7GWTrojan ( 005a60f61 )
Cybereasonmalicious.86e93b
VirITTrojan.Win32.Generic.BDPN
CyrenW32/Zbot.OQ.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Kryptik.BSIW
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGeneric.Dacic.A82088AB.A.6888F051
SUPERAntiSpywareTrojan.Agent/Gen-Falcomp
AvastWin32:Evo-gen [Trj]
TencentMalware.Win32.Gencirc.10bee3cb
TACHYONTrojan/W32.Agent.224365.B
EmsisoftGeneric.Dacic.A82088AB.A.6888F051 (B)
F-SecureTrojan.TR/Crypt.XPACK.Gen7
DrWebTrojan.DownLoader9.8340
VIPREGeneric.Dacic.A82088AB.A.6888F051
TrendMicroTSPY_ZBOT.SM3R
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
Trapminemalicious.high.ml.score
SophosMal/Generic-S
IkarusTrojan.Win32.Crypt
GDataGeneric.Dacic.A82088AB.A.6888F051
AviraTR/Crypt.XPACK.Gen7
Antiy-AVLTrojan/Win32.Yakes
ArcabitGeneric.Dacic.A82088AB.A.6888F051
ViRobotTrojan.Win.Z.Dacic.224365.ABK
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftRansom:Linux/Filecoder.R!MTB
GoogleDetected
AhnLab-V3Trojan/Win.Yakes.R582293
BitDefenderThetaGen:NN.ZexaF.36302.ny1@aSB1mOgO
ALYacGeneric.Dacic.A82088AB.A.6888F051
MAXmalware (ai score=89)
Cylanceunsafe
PandaTrj/Genetic.gen
TrendMicro-HouseCallTSPY_ZBOT.SM3R
RisingSpyware.Zbot!1.A1BA (CLASSIC)
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Yakes.dwzw
FortinetW32/Wacatac.B!tr
AVGWin32:Evo-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Ransom:Linux/Filecoder.R!MTB?

Ransom:Linux/Filecoder.R!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment