Ransom

What is “Ransom:Win32/LockScreen.LK!MTB”?

Malware Removal

The Ransom:Win32/LockScreen.LK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom:Win32/LockScreen.LK!MTB virus can do?

  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Unconventionial language used in binary resources: Korean
  • The binary likely contains encrypted or compressed data.

How to determine Ransom:Win32/LockScreen.LK!MTB?



File Info:

crc32: 892D2C68
md5: 9c9c1b873b9fc0e2c96991f4242a98b1
name: 9C9C1B873B9FC0E2C96991F4242A98B1.mlw
sha1: 04139ec60bd60239c65d1b41c1b02b4967111981
sha256: 7c55d749375560e440889507ca6f6122667275cde025935a0c18892fa60b88df
sha512: 97b1f209500a0132e264d4fc24cbc9edddf3cc432a738a29ec7320380cac214fbcb6becaaae68449220d5df8997a94fc5bb0e7dcd44860d01e71eefafb838c5a
ssdeep: 24576:j6cJjFPl8sjW3u5YRlpJww2eXCA3YA8v1mjGVTeAJjslgN:VVEsjd5YlAwt3mVqAZS
type: PE32 executable (GUI) Intel 80386, for MS Windows


Version Info:

LegalCopyright: Copyright (C) 2021
InternalName: seckey-x64-sha256.exe
FileVersion: 1.0.0.1
CompanyName: MS-Compatibility
ProductName: seckey-x64-sha2561.exe
ProductVersion: 1.0.0.1
OriginalFilename: seckey-x64-sha256.exe
Translation: 0x0412 0x04b0

Ransom:Win32/LockScreen.LK!MTB also known as:

BkavW32.AIDetect.malware2
Elasticmalicious (high confidence)
CynetMalicious (score: 99)
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_90% (W)
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:MalwareX-gen [Trj]
KasperskyHEUR:Trojan.Win32.Khalesi.gen
BitDefenderThetaGen:NN.ZexaE.34670.tv0@aanPp7lG
FireEyeGeneric.mg.9c9c1b873b9fc0e2
SentinelOneStatic AI – Malicious PE
AviraHEUR/AGEN.1117667
eGambitUnsafe.AI_Score_100%
MicrosoftRansom:Win32/LockScreen.LK!MTB
GDataWin32.Trojan.Agent.VLOFYI
AhnLab-V3Trojan/Win.Ransomlock.C4405089
McAfeeArtemis!9C9C1B873B9F
VBA32BScope.Trojan.Khalesi
MalwarebytesMachineLearning/Anomalous.95%
PandaTrj/CI.A
IkarusTrojan.Win32.LockScreen
FortinetW32/LockScreen.BPL!tr
AVGWin32:MalwareX-gen [Trj]
Qihoo-360Win32/Ransom.PornoBlocker.HgIASSQA

How to remove Ransom:Win32/LockScreen.LK!MTB?

Ransom:Win32/LockScreen.LK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment