Categories: Ransom

Ransom:Win32/Crowti (file analysis)

The Ransom:Win32/Crowti is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/Crowti virus can do?

Executable code extraction
Injection (inter-process)
Creates RWX memory
Mimics the system’s user agent string for its own requests
Deletes its original binary from disk
Exhibits behavior characteristic of Cryptowall ransomware
Installs itself for autorun at Windows startup
Creates a copy of itself
Anomalous binary characteristics

How to determine Ransom:Win32/Crowti?


File Info:
crc32: 0D2D4033md5: 7a15645d785d718ecfc1830e1e64b48bname: 7A15645D785D718ECFC1830E1E64B48B.mlwsha1: a386441f921a177b4c4dbda0e618ef23afa3cfc9sha256: 89da68ad239f14a7b4fd03402585d56a3a24bb37c14b22f968a5633144c65253sha512: 806ddd18daf69ce9daa98efdc138d22af1a6a8389011ca1bba30a74241b162d5fe66044255a44733d28e7f50287e1bb80971f7642940c9eebf4edd1defe5cf85ssdeep: 3072:41jdIhDC7eDK5UL4Tcugrk77cSbLtGVm6dOXgYO5sm:4xKhDCqDK594ugrk7/tQm66jmtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright:                                                                                                     FileVersion:                     CompanyName: Scott Brogden                                               Comments: This installation was built with Inno Setup.ProductName: Ditto                                                       ProductVersion:                     FileDescription: Ditto Setup                                                 Translation: 0x0000 0x04b0

Ransom:Win32/Crowti also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.3716
Cynet	Malicious (score: 100)
ALYac	Trojan.Ransom.AOQ
Cylance	Unsafe
Zillya	Trojan.Cryptodef.Win32.2442
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	TrojanDropper:Win32/dropper.ali1003001
K7GW	Trojan ( 0055e3ef1 )
K7AntiVirus	Trojan ( 0055e3ef1 )
Symantec	Ransom.Cryptodefense
ESET-NOD32	Win32/Filecoder.CryptoWall.G
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Trojan-Ransom.Win32.Cryptodef.adrk
BitDefender	Trojan.Ransom.AOQ
NANO-Antivirus	Trojan.Win32.AD.eaapel
MicroWorld-eScan	Trojan.Ransom.AOQ
Tencent	Malware.Win32.Gencirc.114c3b0e
Ad-Aware	Trojan.Ransom.AOQ
Sophos	Mal/Generic-S
Comodo	Malware@#1jjyb12gdvp6d
F-Secure	Heuristic.HEUR/AGEN.1121426
BitDefenderTheta	Gen:NN.ZexaF.34608.hm1@aKbfrqiO
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_CRYPWALL.F117IS
McAfee-GW-Edition	BehavesLike.Win32.Triusor.ch
FireEye	Generic.mg.7a15645d785d718e
Emsisoft	Trojan.Ransom.AOQ (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Cryptodef.acn
Avira	HEUR/AGEN.1121426
Antiy-AVL	Trojan/Win32.BTSGeneric
Microsoft	Ransom:Win32/Crowti
Arcabit	Trojan.Ransom.AOQ
ZoneAlarm	Trojan-Ransom.Win32.Cryptodef.adrk
GData	Trojan.Ransom.AOQ
AhnLab-V3	Trojan/Win32.Crowti.C1322110
Acronis	suspicious
McAfee	RDN/Ransom.cz
MAX	malware (ai score=100)
VBA32	OScope.Malware-Cryptor.Cobalt
Malwarebytes	Malware.Heuristic.1004
Panda	Trj/CI.A
TrendMicro-HouseCall	Ransom_CRYPWALL.F117IS
Rising	Ransom.Crowti!8.37D (CLOUD)
Yandex	Trojan.Cryptodef!U67B7SoCHU4
Ikarus	Trojan.Win32.Filecoder
Fortinet	W32/Filecoder_CryptoWall.G!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml
Qihoo-360	Win32/Ransom.Cryptodef.HxQBum0A