Should I remove “Ransom:Win32/Egregor.UX!MTB”?

The Ransom:Win32/Egregor.UX!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/Egregor.UX!MTB virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Ransom:Win32/Egregor.UX!MTB?


File Info:
name: 49A6FB8EE6A08459A404.mlw
path: /opt/CAPEv2/storage/binaries/7222c8acc69a7598989c335d528b366f801a41b434cbf928c6aef01f8e54f57a
crc32: 5013E372
md5: 49a6fb8ee6a08459a404b27f9e2b868b
sha1: 5da8a11917e18dbf81033f973c0a2f0d8854e43b
sha256: 7222c8acc69a7598989c335d528b366f801a41b434cbf928c6aef01f8e54f57a
sha512: 582813df63b71e1f831c37fa01c637fda501d32321d58da4d791e1c0305016dacca78e1c029c1e0d5e9fb79b8989f61239667501519b6ee64ad8fe34b9359257
ssdeep: 12288:TMM/++6FdtTCM6v/Z8lnoZMaor/OWMKnOg7mE:TMMWjeuoKasLOgq
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T16D05CF10788042F2C8EA20F947EC71B214ADB8F14B295EC756DC0AFFD9645D17B36B6A
sha3_384: f5cc0675dc2c1aedcbceea1147897cbf2d841e3a258c3293234e36571069a72d12805bcaa2a8fdfb5ec5180b829fb67b
ep_bytes: e9a8d60000e9d4040400e95be30100e9
timestamp: 2020-09-22 21:17:23

Version Info:
0: [No Data]

Ransom:Win32/Egregor.UX!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Egregor.j!c
Elastic	Windows.Ransomware.Egregor
MicroWorld-eScan	Gen:Variant.Mikey.115731
Skyhigh	Ransom-Egregor!49A6FB8EE6A0
ALYac	Trojan.Ransom.Egregor
Cylance	unsafe
Sangfor	Ransom.Win32.Egregor.gen
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/Egregor.228de13f
K7GW	Trojan ( 00569bea1 )
K7AntiVirus	Trojan ( 00569bea1 )
Arcabit	Trojan.Mikey.D1C413
BitDefenderTheta	Gen:NN.ZedlaF.36680.XC4@aOnSKHn
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Kryptik.HEDE
Cynet	Malicious (score: 100)
ClamAV	Win.Ransomware.Egregor-9774521-0
Kaspersky	HEUR:Trojan-Ransom.Win32.Egregor.gen
BitDefender	Gen:Variant.Mikey.115731
NANO-Antivirus	Trojan.Win32.Egregor.hzspqk
Avast	Win32:CrypterX-gen [Trj]
Tencent	Malware.Win32.Gencirc.10bdfd5f
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Redcap.fhkui
DrWeb	Trojan.Encoder.32897
VIPRE	Gen:Variant.Mikey.115731
TrendMicro	Ransom.Win32.EGREGOR.SMYAAK-J
Emsisoft	Gen:Variant.Mikey.115731 (B)
Ikarus	Trojan-Ransom.Egregor
Jiangmin	Trojan.Egregor.e
Varist	W32/Kryptik.CGQ.gen!Eldorado
Avira	TR/Redcap.fhkui
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	Win32.Trojan-Ransom.Generic.a
Microsoft	Ransom:Win32/Egregor.UX!MTB
ViRobot	Trojan.Win32.S.Agent.809472.F
ZoneAlarm	HEUR:Trojan-Ransom.Win32.Egregor.gen
GData	Win32.Trojan-Ransom.Egregor.A
Google	Detected
AhnLab-V3	Trojan/Win32.Cryptor.C4064147
McAfee	Ransom-Egregor!49A6FB8EE6A0
TACHYON	Ransom/W32.Egregor.809472.B
VBA32	TrojanRansom.Egregor
Malwarebytes	Malware.AI.4179401798
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Ransom.Win32.EGREGOR.SMYAAK-J
Rising	Trojan.Generic@AI.100 (RDML:IbPgp9xQWLtmg2n6QjBfHw)
Yandex	Trojan.Kryptik!0MgiuyXSJJA
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.108856364.susgen
Fortinet	unknown
AVG	Win32:CrypterX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Ransom:Win32/Egregor.UX!MTB?

Ransom:Win32/Egregor.UX!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X