Ransom:Win32/Conti.WEN!MTB information

The Ransom:Win32/Conti.WEN!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/Conti.WEN!MTB virus can do?

Authenticode signature is invalid

How to determine Ransom:Win32/Conti.WEN!MTB?


File Info:
name: 84AC1D178F33CEEF94C4.mlw
path: /opt/CAPEv2/storage/binaries/0864d94447255fe00911c22fe2a182e171e1c3e8e6bfc0552929a61cca27d662
crc32: A0C75515
md5: 84ac1d178f33ceef94c46061398eedd9
sha1: 6972381fc8113ed17cb9c885da8b6c356f5a9552
sha256: 0864d94447255fe00911c22fe2a182e171e1c3e8e6bfc0552929a61cca27d662
sha512: a3e8eba0a78aff21d8ec23080a73c6be83d6917605e48751684101a4af613a9bd54d4f3cd85b34046114aac0954b1324491d1ac1d4cd25ca83493be3e387d604
ssdeep: 49152:lm1ae2BwHBb7irD7zOEETjmHhp2W0AQS2wQDIevey0DNzJWN:g1+B1Bp2W0AQS2wQiykN
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DCD59DB2FB049132E5D201F1891D2B6F8C58953403B940D7E2D53AD969E0FE36B36BA7
sha3_384: 9cb7bae9fab28fdac89944afb12fc945422cb49e1291e86ced6b36482bf701a1bac6a96196c1afd55eb906c32c2136d0
ep_bytes: e8300a0000e97afeffffcccccccccc51
timestamp: 2023-03-03 09:40:13

Version Info:
0: [No Data]

Ransom:Win32/Conti.WEN!MTB also known as:

Lionic	Trojan.Win32.Sdum.4!c
Elastic	malicious (high confidence)
FireEye	Gen:Variant.Zusy.449356
McAfee	Artemis!84AC1D178F33
Cylance	unsafe
VIPRE	Gen:Variant.Zusy.449356
Sangfor	Trojan.Win32.Conti.Vo6v
K7AntiVirus	Trojan ( 0059efcd1 )
Alibaba	Ransom:Win32/Conti.d7a579b3
K7GW	Trojan ( 0059efcd1 )
CrowdStrike	win/malicious_confidence_70% (D)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.GFZL
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Zusy.449356
MicroWorld-eScan	Gen:Variant.Zusy.449356
Avast	Win32:Malware-gen
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1255004
TrendMicro	Ransom_Conti.R002C0DC323
McAfee-GW-Edition	BehavesLike.Win32.Dropper.vh
Emsisoft	Gen:Variant.Zusy.449356 (B)
GData	Win32.Trojan.PSE.1B8IIM5
Avira	HEUR/AGEN.1255004
Antiy-AVL	Trojan/Win32.GenKryptik
Arcabit	Trojan.Zusy.D6DB4C
ZoneAlarm	UDS:Trojan.Win32.Agent.gen
Microsoft	Ransom:Win32/Conti.WEN!MTB
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R559169
ALYac	Gen:Variant.Zusy.449356
MAX	malware (ai score=83)
Malwarebytes	Malware.AI.2521190562
TrendMicro-HouseCall	Ransom_Conti.R002C0DC323
Rising	Trojan.Generic@AI.100 (RDML:Db1DfudNl9zEf9VaZ3hi4A)
Ikarus	Trojan.Win32.Krypt
Fortinet	W32/GenKryptik.GFZL!tr
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen

How to remove Ransom:Win32/Conti.WEN!MTB?

Ransom:Win32/Conti.WEN!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X