About “Ransom:Win32/Phobos.PB!MTB” infection

The Ransom:Win32/Phobos.PB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/Phobos.PB!MTB virus can do?

The binary likely contains encrypted or compressed data.
Collects information to fingerprint the system

How to determine Ransom:Win32/Phobos.PB!MTB?


File Info:
crc32: 0BF912AE
md5: f25d6500ea695db2da9942101bb18488
name: F25D6500EA695DB2DA9942101BB18488.mlw
sha1: 6357251399d2d7f60a14e9cb731f69e66a3e630e
sha256: ac3b3fb5feac1dbe5ee9a0f9060bb446f6f4e7ac5165a46ebe63551c6e8a0c90
sha512: 6b2d46e6c994cd9ec35b4e9797ef338439acbb2056d10c5dacf40d9acd94da8a2d42a36c30a53c0c2c143158a0bfca3ecfd5cb97ad94e77beae03558651773dd
ssdeep: 1536:R4tlurtmQjXCNNgoy+tBc50MIHd8W+5Hj7KYL/g1qOtCBb:R4tlurtmQjXQgoy+bcuR+WSKYU14b
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Ransom:Win32/Phobos.PB!MTB also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.599308
FireEye	Generic.mg.f25d6500ea695db2
McAfee	Artemis!F25D6500EA69
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Razy.599308
CrowdStrike	win/malicious_confidence_90% (W)
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:RansomX-gen [Ransom]
ClamAV	Win.Ransomware.Razy-9760848-0
Kaspersky	HEUR:Trojan-Ransom.Win32.Cryptor.vho
NANO-Antivirus	Trojan.Win32.Cryptor.imjkyk
Rising	Trojan.Filecoder!8.68 (TFE:dGZlOgQtrzhKPog1sg)
Ad-Aware	Gen:Variant.Razy.599308
Emsisoft	Gen:Variant.Razy.599308 (B)
F-Secure	Heuristic.HEUR/AGEN.1102422
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.ph
Sophos	Mal/Generic-S
Ikarus	Trojan-Ransom.Phobos
Jiangmin	Trojan.Cryptor.sf
Avira	HEUR/AGEN.1102422
MAX	malware (ai score=85)
Antiy-AVL	Trojan[Ransom]/Win32.Makop
Microsoft	Ransom:Win32/Phobos.PB!MTB
Arcabit	Trojan.Razy.D9250C
ZoneAlarm	HEUR:Trojan-Ransom.Win32.Cryptor.vho
GData	Gen:Variant.Razy.599308
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4057905
BitDefenderTheta	Gen:NN.ZexaF.34590.duW@auQGAJ
VBA32	BScope.TrojanSpy.Zbot
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Filecoder.Phobos.E
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Phobos.E!tr.ransom
AVG	Win32:RansomX-gen [Ransom]
Cybereason	malicious.0ea695
Qihoo-360	HEUR/QVM20.1.8A61.Malware.Gen

How to remove Ransom:Win32/Phobos.PB!MTB?

Ransom:Win32/Phobos.PB!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X