Ransom

What is “Ransom:MSIL/CobraLocker.DE!MTB”?

Malware Removal

The Ransom:MSIL/CobraLocker.DE!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom:MSIL/CobraLocker.DE!MTB virus can do?

  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

How to determine Ransom:MSIL/CobraLocker.DE!MTB?



File Info:

crc32: 9F9F8239
md5: 22aa5c5cdabeae3b53f8cc1fe0b0b3d9
name: 22AA5C5CDABEAE3B53F8CC1FE0B0B3D9.mlw
sha1: a31ff961b82106ea0690674284dac8deecb0e51e
sha256: 0a2eec2f7efef0461045abae61fb46337cb4dc8dcf5ea40c7658ca621c29cac8
sha512: 9e845b2d447bce42fa47662e3074d7a5f947f183db92ed6f5cb880e6b52fa717a467c39a05145c465b08fb67945ef6afda8e2c776a23175b2ffed91560f585b2
ssdeep: 384:QsMFaGVg//gEb/yH0dCuzcJybNTu/pTkcLQm1+ZVC:xG8/ge/yH0hbbNTQSZg
type: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows


Version Info:

Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2020
Assembly Version: 1.0.0.0
InternalName: RunAsDll.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: RunDll_4
ProductVersion: 1.0.0.0
FileDescription: RunDll_4
OriginalFilename: RunAsDll.exe

Ransom:MSIL/CobraLocker.DE!MTB also known as:

MicroWorld-eScanGen:Variant.Bulz.103956
FireEyeGen:Variant.Bulz.103956
CAT-QuickHealTrojanRansom.MSIL
McAfeeArtemis!22AA5C5CDABE
CylanceUnsafe
AegisLabTrojan.MSIL.Gen.j!c
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005772431 )
BitDefenderGen:Variant.Bulz.103956
K7GWTrojan ( 005772431 )
Cybereasonmalicious.cdabea
BitDefenderThetaGen:NN.ZemsilF.34590.bm0@aa46RQc
CyrenW32/Trojan.YSIU-0383
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Filecoder.ACK
APEXMalicious
AvastWin32:Trojan-gen
KasperskyHEUR:Trojan-Ransom.MSIL.Gen.gen
AlibabaRansom:MSIL/CobraLocker.73b6d76d
Ad-AwareGen:Variant.Bulz.103956
EmsisoftGen:Variant.Bulz.103956 (B)
F-SecureTrojan.TR/Ransom.rdobz
DrWebTrojan.Encoder.33445
ZillyaTrojan.Ransom.Win32.1967
TrendMicroRansom_Gen.R002C0WB321
McAfee-GW-EditionArtemis!Trojan
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
WebrootW32.Trojan.Gen
AviraTR/Ransom.rdobz
MAXmalware (ai score=100)
Antiy-AVLTrojan[Ransom]/MSIL.Gen
MicrosoftRansom:MSIL/CobraLocker.DE!MTB
ArcabitTrojan.Bulz.D19614
ZoneAlarmHEUR:Trojan-Ransom.MSIL.Gen.gen
GDataGen:Variant.Bulz.103956
CynetMalicious (score: 85)
ALYacTrojan.Ransom.Filecoder
MalwarebytesTrojan.Dropper
PandaTrj/GdSda.A
TrendMicro-HouseCallRansom_Gen.R002C0WB321
RisingRansom.Gen!8.DE83 (CLOUD)
IkarusTrojan-Ransom.FileCrypter
MaxSecureTrojan.Malware.73762894.susgen
FortinetW32/Gen.ACK!tr.ransom
AVGWin32:Trojan-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Win32/Ransom.Generic.HgIASOQA

How to remove Ransom:MSIL/CobraLocker.DE!MTB?

Ransom:MSIL/CobraLocker.DE!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment