Ransom

Ransom:MSIL/Crylocker.PAA!MTB removal guide

Malware Removal

The Ransom:MSIL/Crylocker.PAA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom:MSIL/Crylocker.PAA!MTB virus can do?

  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid

How to determine Ransom:MSIL/Crylocker.PAA!MTB?



File Info:

name: C1B753E693A246A447A0.mlw
path: /opt/CAPEv2/storage/binaries/49248ccb05b240860bca77b14d11761f46351c82a5aab48ec9b6702dad7bf15f
crc32: DAFC5EBF
md5: c1b753e693a246a447a0d8c2973d267b
sha1: ab29408679f569598a0707e6eae6f6854ef0399f
sha256: 49248ccb05b240860bca77b14d11761f46351c82a5aab48ec9b6702dad7bf15f
sha512: 1bd86cf18a5bd896355990e1007e4d8d8b08df7f35b2e61f7355ef8d3135c287ecf0868204312a0e2637e15e69f69e7e7646c4cbc8970ac01ca39e1fb899f197
ssdeep: 3072:i+8cpoW8cpW8cpXKtac8cpt8cpn8cp+9h73YEXDtVxD1DtiLpTpR/5QF:izNSq7fpyRG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12355FE64BEAE50D8D8E1D6381238E17165EE8D08BB93771AD7E5BE633E31EB1050580F
sha3_384: 9820d7e50d523283be13c389986d1b0f5584aea9c04fbde89d27a7d9a87549b09f1280f30bf20203ac8e57bbc0f224d2
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-10-01 02:50:33


Version Info:

Translation: 0x0000 0x04b0
CompanyName: Microsoft
FileDescription: @CryLocker@.exe
FileVersion: 1.0.0.0
InternalName: @Crylocker@.exe.exe
LegalCopyright: Copyright © Microsoft 2021
OriginalFilename: @Crylocker@.exe.exe
ProductName: @CryLocker@.exe
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ransom:MSIL/Crylocker.PAA!MTB also known as:

LionicTrojan.MSIL.Diztakun.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.MSILHeracles.26934
FireEyeGen:Variant.MSILHeracles.26934
McAfeeGenericRXAA-AA!C1B753E693A2
CylanceUnsafe
ZillyaTrojan.Filecoder.Win32.20419
SangforRansom.MSIL.Filecoder.FG
K7AntiVirusTrojan ( 00508ebf1 )
AlibabaTrojan:MSIL/Crylocker.48c5b487
K7GWTrojan ( 00508ebf1 )
BitDefenderThetaGen:NN.ZemsilF.34182.vr0@ail6Uhc
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Filecoder.FG
TrendMicro-HouseCallTROJ_GEN.R002C0RJ221
Paloaltogeneric.ml
KasperskyHEUR:Trojan.MSIL.Diztakun.gen
BitDefenderGen:Variant.MSILHeracles.26934
AvastWin32:Trojan-gen
TencentMsil.Trojan.Diztakun.Sxxv
EmsisoftGen:Variant.MSILHeracles.26934 (B)
TrendMicroTROJ_GEN.R002C0RJ221
McAfee-GW-EditionArtemis!Trojan
SophosMal/StupCryp-A
SentinelOneStatic AI – Suspicious PE
AviraTR/Ransom.hocjy
MAXmalware (ai score=81)
MicrosoftRansom:MSIL/Crylocker.PAA!MTB
ZoneAlarmHEUR:Trojan.MSIL.Diztakun.gen
GDataGen:Variant.MSILHeracles.26934
CynetMalicious (score: 99)
AhnLab-V3Trojan/Win.Generic.C4673878
VBA32TScope.Trojan.MSIL
ALYacGen:Variant.MSILHeracles.26934
MalwarebytesMalware.AI.145687847
APEXMalicious
RisingTrojan.Generic/MSIL@AI.96 (RDM.MSIL:fhRVzRTlpYV98RpAIl9V7w)
IkarusTrojan-Ransom.FileCrypter
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/Filecoder.AA0F!tr.ransom
AVGWin32:Trojan-gen
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Ransom:MSIL/Crylocker.PAA!MTB?

Ransom:MSIL/Crylocker.PAA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment