Ransom

About “Ransom:MSIL/FileCoder.YG!MTB” infection

Malware Removal

The Ransom:MSIL/FileCoder.YG!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom:MSIL/FileCoder.YG!MTB virus can do?

  • Authenticode signature is invalid
  • Anomalous .NET characteristics
  • CAPE detected the Chaos malware family
  • Binary file triggered YARA rule

How to determine Ransom:MSIL/FileCoder.YG!MTB?



File Info:

name: 024F23EFF975F6989DD2.mlw
path: /opt/CAPEv2/storage/binaries/75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734
crc32: 06727FAF
md5: 024f23eff975f6989dd2dc4340886961
sha1: d553862c0cb3ab3ad5cba7654c038c966ebc9a00
sha256: 75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734
sha512: 4c62ebc36cca4ef4ff9d59e8497047436a7f9f51d78d9dc6d29a657052b997479378d46fc5616150bc62cb7211e623c2012fdd7cca2b4e96f54e64d61975e98a
ssdeep: 24576:s1S4lQMNWi3VesNY8106qPN4K3P0QcejoMZLyiTtiFfkOfE:s1Sy6PX3PpM+P5Id
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E6D52D3839EA9019F1B3EF7A6FD4B9D7DA9FB7733A0294191081034B4623A81DD9153E
sha3_384: fc73d56ffe8ee69c4ca2c4bd8d06ba268cc48203aef5a2909340e6d118aa4a77b7c08fa06c37a4c6e06c5fb51f421276
ep_bytes: ff250020400000000000000000000000
timestamp: 2023-02-17 19:19:04


Version Info:

Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: 600.exe
LegalCopyright:  
OriginalFilename: 600.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Ransom:MSIL/FileCoder.YG!MTB also known as:

BkavW32.CoolmeBowpN.Trojan
LionicTrojan.Win32.Encoder.U!c
DrWebTrojan.Encoder.35905
MicroWorld-eScanGen:Heur.Ransom.Imps.3
CAT-QuickHealTrojan.GenerFC.S29513021
SkyhighGenericRXSY-BP!024F23EFF975
McAfeeGenericRXSY-BP!024F23EFF975
MalwarebytesNeshta.Virus.FileInfector.DDS
ZillyaTrojan.Filecoder.Win32.28843
SangforRansom.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaRansom:MSIL/Filecoder.ad812f0f
K7GWRansomware ( 005a8b921 )
K7AntiVirusRansomware ( 005a8b921 )
BitDefenderThetaAI:Packer.051DB10E1F
VirITTrojan.Win32.Genus.OEA
SymantecTrojan Horse
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Filecoder.Chaos.C
APEXMalicious
TrendMicro-HouseCallRansom.MSIL.SIRATTACKER.THCOABC
ClamAVWin.Ransomware.Hydracrypt-9878672-0
KasperskyHEUR:Trojan-Ransom.Win32.Generic
BitDefenderGen:Heur.Ransom.Imps.3
NANO-AntivirusTrojan.Win32.Encoder.jwdpqt
AvastWin32:RansomX-gen [Ransom]
TencentTrojan-Ransom.Win32.Agent.16000623
TACHYONRansom/W32.DN-Agent.2843136.B
EmsisoftGen:Heur.Ransom.Imps.3 (B)
GoogleDetected
F-SecureHeuristic.HEUR/AGEN.1370958
VIPREGen:Heur.Ransom.Imps.3
TrendMicroRansom.MSIL.SIRATTACKER.THCOABC
FireEyeGeneric.mg.024f23eff975f698
SophosTroj/Ransom-GWT
IkarusTrojan-Ransom.Chaos
JiangminTrojan.Generic.hqbim
WebrootW32.Trojan.Gen
VaristW32/Ransom.QY.gen!Eldorado
AviraHEUR/AGEN.1370958
Antiy-AVLTrojan/MSIL.Filecoder
Kingsoftwin32.troj.undef.a
MicrosoftRansom:MSIL/FileCoder.YG!MTB
XcitiumMalware@#2wmz6045waxhh
ArcabitTrojan.Ransom.Imps.3
ZoneAlarmHEUR:Trojan-Ransom.Win32.Generic
GDataGen:Heur.Ransom.Imps.3
AhnLab-V3Ransomware/Win.Generic.C4734898
VBA32Trojan.MSIL.DelShad.Heur
ALYacTrojan.Ransom.Filecoder
MAXmalware (ai score=100)
Cylanceunsafe
PandaTrj/RansomGen.A
RisingRansom.Destructor!1.B060 (CLASSIC)
YandexTrojan.Filecoder!Hzh45B4FxjY
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.10307848.susgen
FortinetMSIL/Filecoder.APU!tr
AVGWin32:RansomX-gen [Ransom]
Cybereasonmalicious.ff975f
DeepInstinctMALICIOUS
alibabacloudRansomWare

How to remove Ransom:MSIL/FileCoder.YG!MTB?

Ransom:MSIL/FileCoder.YG!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment