Ransom

How to remove “Ransom:Win32/AvosLocker.MBK!MTB”?

Malware Removal

The Ransom:Win32/AvosLocker.MBK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Ransom:Win32/AvosLocker.MBK!MTB virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Enumerates running processes
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Authenticode signature is invalid
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Attempts to delete or modify volume shadow copies
  • Writes a potential ransom message to disk
  • Modifies boot configuration settings
  • Uses suspicious command line tools or Windows utilities

How to determine Ransom:Win32/AvosLocker.MBK!MTB?


File Info:

name: 78136A1B026D397CE0E1.mlw
path: /opt/CAPEv2/storage/binaries/1ee20380453e5135081066bcdfa8dbc89ffb631312374719036f97e5146262e4
crc32: A453647B
md5: 78136a1b026d397ce0e1c386da39b0d9
sha1: 65c2b3246c6470e823f3f92f557cfc44f360740e
sha256: 1ee20380453e5135081066bcdfa8dbc89ffb631312374719036f97e5146262e4
sha512: 497fe8a3843b1a9dcb743fa07b97439f45194b8a394fb6c549a834d0dfaf36c7e47593107e984c84711a58461e8a703c5fab0db25f38e87c3ef667dba761945a
ssdeep: 6144:ZEx0dIFx2EJX619pFyB5pTFhkKByp2KDiFyJ4PjV8x+jVG+OQHDXjFC/cVW:Z81FYWc6vkIyp2KDLJUq2V3T7jY0c
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1D55423EF11C06325E1461FFFA87C350100BBBDF409A263EF019AEF986F457A96AA1517
sha3_384: 7d452a9fca23ee0a5bede4585dace92f2c69f6b200f5309678f79dc67d4e943eba75323767dc614addbd291382ccdb8b
ep_bytes: 60be00e048008dbe0030f7ffc7873852
timestamp: 2021-11-06 03:19:15

Version Info:

0: [No Data]

Ransom:Win32/AvosLocker.MBK!MTB also known as:

LionicTrojan.Win32.DelShad.4!c
Elasticmalicious (moderate confidence)
MicroWorld-eScanDeepScan:Generic.Ransom.AmnesiaE.806DF178
CAT-QuickHealRansom.Avoslocker.S27130740
ALYacTrojan.Ransom.AvosLocker
CylanceUnsafe
SangforRansom.Win32.AvosLocker.MBK!MTB
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojan:Win32/AvosLocker.658d7eaf
K7GWTrojan ( 0058241e1 )
K7AntiVirusTrojan ( 0058241e1 )
SymantecRansom.AvosLocker!gm1
ESET-NOD32a variant of Win32/Filecoder.AvosLocker.A
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Ransomware.Deepscan-9938939-0
KasperskyTrojan.Win32.DelShad.hwr
BitDefenderDeepScan:Generic.Ransom.AmnesiaE.806DF178
AvastWin32:Trojan-gen
TencentWin32.Trojan.Delshad.Agbb
Ad-AwareDeepScan:Generic.Ransom.AmnesiaE.806DF178
EmsisoftDeepScan:Generic.Ransom.AmnesiaE.806DF178 (B)
DrWebTrojan.Encoder.34626
TrendMicroRansom.Win32.AVOSLOCKER.SMYXBLNT
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
FireEyeGeneric.mg.78136a1b026d397c
SophosMal/Generic-S + Troj/Ransom-GOG
IkarusTrojan-Ransom.FileCrypter
GDataDeepScan:Generic.Ransom.AmnesiaE.806DF178
JiangminTrojan.DelShad.buh
AviraHEUR/AGEN.1215253
KingsoftWin32.Troj.Generic_a.a.(kcloud)
ArcabitDeepScan:Generic.Ransom.AmnesiaE.806DF178
ZoneAlarmTrojan.Win32.DelShad.hwr
MicrosoftRansom:Win32/AvosLocker.MBK!MTB
CynetMalicious (score: 100)
AhnLab-V3Ransomware/Win.AvosLocker.C4963620
McAfeeArtemis!78136A1B026D
MAXmalware (ai score=82)
VBA32BScope.TrojanRansom.Cryptor
MalwarebytesRansom.AvosLocker
RisingRansom.AvosLocker!8.12EE0 (CLOUD)
YandexTrojan.DelShad!P4KTmYQXcHU
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Filecoder.OHU!tr.ransom
BitDefenderThetaGen:NN.ZexaF.34638.rmGfaa1nyhni
AVGWin32:Trojan-gen
Cybereasonmalicious.b026d3
PandaTrj/GdSda.A

How to remove Ransom:Win32/AvosLocker.MBK!MTB?

Ransom:Win32/AvosLocker.MBK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment