What is “Ransom:Win32/FileCryptor.K!MTB”?

Malware Removal

The Ransom:Win32/FileCryptor.K!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Ransom:Win32/FileCryptor.K!MTB virus can do?

  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Unconventionial language used in binary resources: Russian
  • Writes a potential ransom message to disk
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Ransom:Win32/FileCryptor.K!MTB?


File Info:

crc32: DEF72235
md5: 01a378b49db5cdae61453520e58fd7a8
name: upload_file
sha1: dc6a61e931d0f74a48b3c38e098f2f28bede28f2
sha256: 04d8109c6c78055d772c01fefe1e5f48a70f2a65535cff17227b5a2c8506b831
sha512: c3dfa6a82591c09f795395e91d160e894f50e85a6ad44808a5d6fcb6a14c78927baaf856d2b0985732de29f5889c8834e6cc2de6e4182007cbc678c0909136f0
ssdeep: 12288:CjEiyrFmeLmbWAUVAyu2kLV13E4PmKvymcesKxt5Z3y+pIhfJhkiMySTXdv5MiW6:sEbfmbWcymjabesKxt5Z3y+pIhfJhkiK
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Ransom:Win32/FileCryptor.K!MTB also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Barys.62761
Qihoo-360Win32/Trojan.Ransom.74e
ALYacGen:Variant.Barys.62761
CylanceUnsafe
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderGen:Variant.Barys.62761
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.931d0f
CyrenW32/Filecoder.U.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Malware-gen
KasperskyHEUR:Trojan-Ransom.Win32.Cryakl.gen
NANO-AntivirusTrojan.Win32.Cryakl.hqhjwt
Ad-AwareGen:Variant.Barys.62761
EmsisoftGen:Variant.Barys.62761 (B)
F-SecureTrojan.TR/FileCryptor.ereit
DrWebTrojan.Encoder.32204
ZillyaTrojan.Cryakl.Win32.500
FireEyeGeneric.mg.01a378b49db5cdae
AviraTR/FileCryptor.ereit
MAXmalware (ai score=89)
Antiy-AVLTrojan[Ransom]/Win32.Cryakl
MicrosoftRansom:Win32/FileCryptor.K!MTB
ArcabitTrojan.Barys.DF529
ZoneAlarmHEUR:Trojan-Ransom.Win32.Cryakl.gen
GDataGen:Variant.Barys.62761
CynetMalicious (score: 90)
ESET-NOD32Win32/Filecoder.EQ
RisingTrojan.Generic@ML.85 (RDMK:p1MFGH+lXMPKhiLNAUsfbQ)
IkarusTrojan-Ransom.FileCrypter
FortinetW32/Filecoder.EQ!tr.ransom
BitDefenderThetaGen:NN.ZelphiF.34566.QGW@aGQOB6mc
AVGWin32:Malware-gen
MaxSecureTrojan.Malware.73995288.susgen

How to remove Ransom:Win32/FileCryptor.K!MTB?

Ransom:Win32/FileCryptor.K!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment