Ransom

Ransom:MSIL/GhostCrypt.PAA!MTB removal

Malware Removal

The Ransom:MSIL/GhostCrypt.PAA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom:MSIL/GhostCrypt.PAA!MTB virus can do?

  • Dynamic (imported) function loading detected
  • Authenticode signature is invalid

How to determine Ransom:MSIL/GhostCrypt.PAA!MTB?



File Info:

name: 448DF2A2FDDCCAABA4D6.mlw
path: /opt/CAPEv2/storage/binaries/ebba121a265c5f1b9bdfb15441408124f02b9639355354b9c6db1dbdd34fe397
crc32: B0C84F80
md5: 448df2a2fddccaaba4d600993f7886b2
sha1: 0089edc941ea5eed0aff129a1009a4fbbbc87064
sha256: ebba121a265c5f1b9bdfb15441408124f02b9639355354b9c6db1dbdd34fe397
sha512: f303f7b79e2f6f84fc21ef9cbcf5b025aed8c23ede68265c9516c13f78b1ed388c8bf264d3c1b184677a0114837adee967c3221a57a2cb1bdd2d8d5f99b5248c
ssdeep: 6144:vIZHm8pa+dvHRERM/F6IckZfPvvvvvvvvvvvvHHHHvvvvHHHHvvvvHHHjvvnvvvm:QZHxa+dvWYMaFeUfRGqx2KwvD7
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1A1B42901EFDCD5AFD04E2336A13BA658522DC1C75203EB4759886BBABD4238DCD263D6
sha3_384: fbcf53379218a0a1bcd675a0ebc9aaf2a82d55ab3d393ab02a7472df1c323fe9118d119f6b112bf6577ca8d48886ad9c
ep_bytes: ff253422480000000000000000000822
timestamp: 2021-12-09 23:07:25


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: Ghost
FileVersion: 1.0.0.0
InternalName: Ghost.exe
LegalCopyright: Copyright ©  2021
LegalTrademarks: 
OriginalFilename: Ghost.exe
ProductName: Ghost
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ransom:MSIL/GhostCrypt.PAA!MTB also known as:

BkavW32.AIDetectNet.01
LionicTrojan.MSIL.Cring.j!c
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
FireEyeGen:Variant.Bulz.403862
McAfeeArtemis!448DF2A2FDDC
MalwarebytesAdware.Tuto4PC
VIPREGen:Variant.Bulz.403862
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaRansom:MSIL/Cring.70ac3826
K7GWRiskware ( 0040eff71 )
K7AntiVirusRiskware ( 0040eff71 )
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Filecoder.AGT
APEXMalicious
KasperskyTrojan-Ransom.MSIL.Cring.t
BitDefenderGen:Variant.Bulz.403862
MicroWorld-eScanGen:Variant.Bulz.403862
AvastWin32:Trojan-gen
TencentMsil.Trojan.Cring.Pcjd
Ad-AwareGen:Variant.Bulz.403862
EmsisoftGen:Variant.Bulz.403862 (B)
DrWebTrojan.EncoderNET.25
ZillyaTrojan.Filecoder.Win32.21274
McAfee-GW-EditionArtemis!Trojan
Trapminemalicious.moderate.ml.score
SophosMal/Generic-S
SentinelOneStatic AI – Suspicious PE
GDataGen:Variant.Bulz.403862
JiangminTrojan.MSIL.alroe
AviraTR/Ransom.uoddw
Antiy-AVLTrojan/Generic.ASMalwS.53F4
ArcabitTrojan.Bulz.D62996
MicrosoftRansom:MSIL/GhostCrypt.PAA!MTB
TACHYONRansom/W32.DN-Cring.527872
AhnLab-V3Trojan/Win.Generic.C4848458
ALYacGen:Variant.Bulz.403862
MAXmalware (ai score=83)
VBA32TScope.Trojan.MSIL
CylanceUnsafe
RisingTrojan.Filecoder!8.68 (CLOUD)
IkarusTrojan-Ransom.FileCrypter
MaxSecureTrojan.Malware.133800539.susgen
FortinetMSIL/Filecoder.AGT!tr.ransom
AVGWin32:Trojan-gen
Cybereasonmalicious.2fddcc
PandaTrj/GdSda.A

How to remove Ransom:MSIL/GhostCrypt.PAA!MTB?

Ransom:MSIL/GhostCrypt.PAA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment