What is “Ransom:MSIL/FireCrypt.MK!MTB”?

The Ransom:MSIL/FireCrypt.MK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:MSIL/FireCrypt.MK!MTB virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ransom:MSIL/FireCrypt.MK!MTB?


File Info:
crc32: 2D338BD7
md5: 7098958688fefa60400bc3cbdcb00908
name: 7098958688FEFA60400BC3CBDCB00908.mlw
sha1: 3762b7f639550a4fef0752f4b6b87ea74f98ddb2
sha256: 890970d48e9a0c326a781d188b6c123f8448ec866a0e1f1e0017e6744353f1b0
sha512: c7423592db80bf274c9b6bec192997bd5cf870334b0444001ade091a906be44dac6f0fb108a0c9fb62d96d73cf87933111706e5f7c9ce59083a4bb931ac27a81
ssdeep: 384:Od7gYEWzLSmeSqjkCg3Sx1b/2kYLTwbZxssim+DHi:XMz9e9jkCw8jnFxMDHi
type: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright:  
Assembly Version: 0.0.0.0
InternalName: ok.exe
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
FileDescription:  
OriginalFilename: ok.exe

Ransom:MSIL/FireCrypt.MK!MTB also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.10090
CAT-QuickHeal	Ransom.FireCrypt.A3
ALYac	DeepScan:Generic.Ransom.C9F04B8E
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
Cyren	W32/Azorult.D.gen!Eldorado
Symantec	Ransom.FireCrypt
ESET-NOD32	a variant of MSIL/Filecoder.DZ
APEX	Malicious
Avast	MSIL:Ransom-AG [Trj]
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.MSIL.DustySky.gen
BitDefender	DeepScan:Generic.Ransom.C9F04B8E
MicroWorld-eScan	DeepScan:Generic.Ransom.C9F04B8E
Ad-Aware	DeepScan:Generic.Ransom.C9F04B8E
Sophos	ML/PE-A + Troj/Ransom-ECK
F-Secure	Heuristic.HEUR/AGEN.1100481
BitDefenderTheta	Gen:NN.ZemsilF.34142.bm0@a8Plpgo
TrendMicro	Ransom_BLEEDGREEN.SMI0
McAfee-GW-Edition	FireCrypt-FBR!7098958688FE
FireEye	Generic.mg.7098958688fefa60
Emsisoft	DeepScan:Generic.Ransom.C9F04B8E (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1100481
Microsoft	Ransom:MSIL/FireCrypt.MK!MTB
Arcabit	DeepScan:Generic.Ransom.C9F04B8E
ZoneAlarm	HEUR:Trojan.MSIL.DustySky.gen
GData	DeepScan:Generic.Ransom.C9F04B8E
AhnLab-V3	Trojan/Win.Generic.C4548208
McAfee	FireCrypt-FBR!7098958688FE
MAX	malware (ai score=83)
Malwarebytes	Backdoor.Agent.PGen
TrendMicro-HouseCall	Ransom_BLEEDGREEN.SMI0
Rising	Ransom.FileCrypt/MSIL!1.D7EF (CLASSIC)
Ikarus	Trojan-Spy.Keylogger
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Generic.AP.550DC!tr
AVG	MSIL:Ransom-AG [Trj]

How to remove Ransom:MSIL/FireCrypt.MK!MTB?

Ransom:MSIL/FireCrypt.MK!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X