Categories: Ransom

How to remove “Ransom:MacOS/FileCoder”?

The Ransom:MacOS/FileCoder is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:MacOS/FileCoder virus can do?

A file was accessed within the Public folder.
Sample contains Overlay data
Uses Windows utilities for basic functionality
Reads data out of its own binary image
Authenticode signature is invalid
A ping command was executed with the -n argument possibly to delay analysis
Checks for the presence of known devices from debuggers and forensic tools
Checks for the presence of known devices from debuggers and forensic tools
Deletes executed files from disk
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Ransom:MacOS/FileCoder?


File Info:
name: 1CD367CA3985D0602642.mlwpath: /opt/CAPEv2/storage/binaries/8e253211cf0cc20bba7e660f3f6e1e97dec2246429f1d23b64951039f20249cfcrc32: C4EEDA28md5: 1cd367ca3985d0602642c8f7055d0560sha1: e52e16928796e01be77799c0d3a419a898b1d141sha256: 8e253211cf0cc20bba7e660f3f6e1e97dec2246429f1d23b64951039f20249cfsha512: e1a7e0422525f76adffbea9e8d2ae73ca140f06bc0daa0c87375ddc2a7131d85dfe7be4806878f5385caff564b8978f78602a2a8157ee402c04d772b1c3376f6ssdeep: 49152:vw80cTsjkWaUH5zOvasXRF1Jy4mcwDMFjZCh3cK:I8sjkynsBnJo0j8hvtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T192A5F12273DDC370CBAA9173BF6AB7016EBF38650630B85B1F881D7DA910161166D7A3sha3_384: 7ea5a60bcfea349628ae2722dba11463391ebd0db587487303abc3868b79ad0b57b113b61868deb2434c720801af1d90ep_bytes: e8b8d00000e97ffeffffcccccccccccctimestamp: 2016-11-09 19:57:02
Version Info:
Translation: 0x0809 0x04b0

Ransom:MacOS/FileCoder also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Ishtar.j!c
tehtris	Generic.Malware
DrWeb	Trojan.DownLoader32.54218
MicroWorld-eScan	Trojan.GenericKD.3705394
ClamAV	Win.Ransomware.Ishtar-5
Skyhigh	BehavesLike.Win32.Generic.vc
McAfee	Artemis!1CD367CA3985
Malwarebytes	Malware.AI.870972921
VIPRE	Trojan.GenericKD.3705394
Sangfor	Ransom.Win32.Ishtar.V433
K7AntiVirus	Trojan ( 004fccef1 )
Alibaba	Trojan:Win32/Autoit.ali2000008
K7GW	Trojan ( 004fccef1 )
Cybereason	malicious.28796e
Arcabit	Trojan.Generic.D388A32
VirIT	Trojan.Win32.Dnldr32.DCFI
Symantec	Trojan Horse
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Filecoder.Ishtar.B
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.Ishtar.y
BitDefender	Trojan.GenericKD.3705394
NANO-Antivirus	Trojan.Win32.Ishtar.eiveoj
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Filecoder.Xdkl
Emsisoft	Trojan.GenericKD.3705394 (B)
F-Secure	Heuristic.HEUR/AGEN.1320378
TrendMicro	Ransom_ISHTAR.F116KE
Sophos	Mal/Generic-R
Ikarus	Trojan.Win32.Filecoder
Jiangmin	Trojan.Ishtar.e
Webroot	W32.Trojan.GenKD
Google	Detected
Avira	HEUR/AGEN.1320378
Xcitium	Malware@#1x8xipbwj1kvv
Microsoft	Ransom:MacOS/FileCoder
ZoneAlarm	Trojan-Ransom.Win32.Ishtar.y
GData	Trojan.GenericKD.3705394
Varist	W32/Autoit.IYYO-1460
AhnLab-V3	Trojan/Win32.Ishtar.R190422
VBA32	Trojan.Autoit.Wirus
TACHYON	Ransom/W32.Ishtar.2103892
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Ransom_ISHTAR.F116KE
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.11730479.susgen
Fortinet	W32/Ishtar.B!tr
AVG	Win32:Trojan-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)