Ransom

Should I remove “Ransom:Win32/FileCoder.NC!MTB”?

Malware Removal

The Ransom:Win32/FileCoder.NC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Ransom:Win32/FileCoder.NC!MTB virus can do?

  • Attempts to connect to a dead IP:Port (4 unique times)
  • Possible date expiration check, exits too soon after checking local time
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • A process created a hidden window
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Attempts to restart the guest VM
  • Installs itself for autorun at Windows startup
  • Writes a potential ransom message to disk
  • Creates a hidden or system file
  • Creates a copy of itself
  • Collects information to fingerprint the system
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
2no.co
iplogger.org
a.tomx.xyz

How to determine Ransom:Win32/FileCoder.NC!MTB?


File Info:

crc32: 76CA822D
md5: a95ae4f41cef3feacdf099a288859ce0
name: A95AE4F41CEF3FEACDF099A288859CE0.mlw
sha1: 8411fd22595ed3e5c9242146fc46c8898333f9bc
sha256: 7439e44dc550b38270afde9905db364a29005c204ac250ce347b25654fcfcd41
sha512: f6fc814250ce148c37794e7edc23dd5e3e47b58657286350ab12f2f0a3457458cbc0badc2884b2b1fdf5db341d104ba6b2ea3ddfe0c55d965628c509f8e07f5e
ssdeep: 6144:FpzwZBG5/qjKkY1548r+snqNTRpygDAOMljI4mHH:KukY1548rMTjygDCq4mHH
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Ransom:Win32/FileCoder.NC!MTB also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Encoder.j!c
Elasticmalicious (high confidence)
ALYacTrojan.Ransom.Pico
CylanceUnsafe
ZillyaTrojan.Encoder.Win32.184
AlibabaRansom:Win32/FileCoder.382c12e3
K7GWTrojan ( 0053b7601 )
K7AntiVirusTrojan ( 0053b7601 )
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Filecoder.NSA
APEXMalicious
AvastWin32:Malware-gen
CynetMalicious (score: 100)
KasperskyTrojan-Ransom.Win32.Encoder.nk
BitDefenderGeneric.Ransom.Thanatos.F54B8989
NANO-AntivirusTrojan.Win32.Encoder.fhovby
MicroWorld-eScanGeneric.Ransom.Thanatos.F54B8989
TencentWin32.Trojan.Encoder.Lmuk
Ad-AwareGeneric.Ransom.Thanatos.F54B8989
SophosMal/Generic-R + Troj/Ransom-FAJ
ComodoMalware@#17cw43oaass0o
BitDefenderThetaGen:NN.ZexaF.34142.ouW@ayMxcdfi
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Dropper.dh
FireEyeGeneric.mg.a95ae4f41cef3fea
EmsisoftTrojan.Agent (A)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Encoder.di
AviraHEUR/AGEN.1109036
eGambitUnsafe.AI_Score_100%
Antiy-AVLTrojan/Generic.ASMalwS.286F7B3
MicrosoftRansom:Win32/FileCoder.NC!MTB
ArcabitGeneric.Ransom.Thanatos.F54B8989
GDataGeneric.Ransom.Thanatos.F54B8989
AhnLab-V3Malware/Win32.Generic.C2744802
McAfeeArtemis!A95AE4F41CEF
VBA32BScope.TrojanRansom.Gen
PandaTrj/GdSda.A
RisingRansom.Agent!1.C1EB (CLASSIC)
YandexTrojan.GenAsa!4kkYyTdRLjE
IkarusTrojan-Ransom.FileCrypter
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Filecoder.NSA!tr.ransom
AVGWin32:Malware-gen
Paloaltogeneric.ml

How to remove Ransom:Win32/FileCoder.NC!MTB?

Ransom:Win32/FileCoder.NC!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment