Ransom

Ransom:Win32/Ergop (file analysis)

Malware Removal

The Ransom:Win32/Ergop is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Ransom:Win32/Ergop virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Attempts to connect to a dead IP:Port (5 unique times)
  • A process created a hidden window
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Attempts to modify proxy settings
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
icaterp.com
iplogger.org
apps.identrust.com
isrg.trustid.ocsp.identrust.com
ocsp.int-x3.letsencrypt.org

How to determine Ransom:Win32/Ergop?


File Info:

crc32: 2F798340
md5: 42e13e9fb45e01c567b6d3c34caab781
name: 42E13E9FB45E01C567B6D3C34CAAB781.mlw
sha1: 97b2eaec93100f16d1878e6903896eb00f626925
sha256: cca3df47e9579ccc7c35bee02c9ab2c1b55643e50e57528abf840229b5d082a8
sha512: 7d98335fc2c6f08deca2ed814c702c45a20cbf197d93d7a6a1b2d4223aadbf10483c456a8b326d0d4debf63cb3c499af745203c92ac19b21807b0b2b7693391a
ssdeep: 1536:dLGFYt0df8opIRh0fyAqg010IpeqsR0FiRfA/bph3C6Ptz:YFY4kJX02ga7lsRUZplC61
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Ransom:Win32/Ergop also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Siggen2.59718
MicroWorld-eScanTrojan.GenericKD.35215961
CAT-QuickHealTrojan.Jobutyve
McAfeeRDN/Generic.grp
CylanceUnsafe
SangforMalware
K7AntiVirusTrojan ( 005732b01 )
BitDefenderTrojan.GenericKD.35215961
K7GWTrojan ( 005732b01 )
Cybereasonmalicious.c93100
TrendMicroTROJ_GEN.R002C0PKG20
BitDefenderThetaGen:NN.ZexaF.34634.fuY@aS!HJ8fi
SymantecML.Attribute.HighConfidence
TrendMicro-HouseCallTROJ_GEN.R002C0PKG20
AvastWin32:Trojan-gen
KasperskyHEUR:Trojan.Win32.Jobutyve.gen
AlibabaTrojan:Win32/GenKryptik.8a69e05e
NANO-AntivirusTrojan.Win32.Jobutyve.ibcwhd
Ad-AwareTrojan.GenericKD.35215961
SophosMal/Generic-S
F-SecureTrojan.TR/Kryptik.bozjv
VIPRETrojan.Win32.Generic!BT
InvinceaMal/Generic-S
McAfee-GW-EditionRDN/Generic.grp
FireEyeGeneric.mg.42e13e9fb45e01c5
EmsisoftTrojan.GenericKD.35215961 (B)
IkarusTrojan.Win32.Krypt
WebrootW32.Trojan.Gen
AviraTR/Kryptik.bozjv
Antiy-AVLTrojan/Win32.GenKryptik
MicrosoftRansom:Win32/Ergop
GridinsoftTrojan.Win32.Kryptik.oa
ArcabitTrojan.Generic.D2195A59
ZoneAlarmHEUR:Trojan.Win32.Jobutyve.gen
GDataWin32.Trojan.Ilgergop.28WTNU
CynetMalicious (score: 100)
VBA32suspected of Trojan.Downloader.gen.h
ALYacTrojan.GenericKD.35215961
MAXmalware (ai score=82)
MalwarebytesTrojan.MalPack
PandaTrj/GdSda.A
ESET-NOD32Win32/TrojanDownloader.Small.BBX
SentinelOneStatic AI – Malicious PE
FortinetW32/Jobutyve.EJBU!tr
AVGWin32:Trojan-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_90% (D)
Qihoo-360Generic/Trojan.BO.dd1

How to remove Ransom:Win32/Ergop?

Ransom:Win32/Ergop removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment