Categories: Ransom

About “Ransom:Win32/RushCoin” infection

The Ransom:Win32/RushCoin is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/RushCoin virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Ransom:Win32/RushCoin?


File Info:
crc32: 25CE9C88md5: a50a9e1a50a1eaecca93c3c5b95481afname: A50A9E1A50A1EAECCA93C3C5B95481AF.mlwsha1: 5483052017f80fc14e4831306e6f4924bd5fe6bbsha256: aef96c3152cae49fa382f687c2bde01e53144e8341951dd933e8786def3f6ec7sha512: 4ca2b145552398fbfd6b939690df6738e8ee6e22d9cd2342833f3d62319377a7afad3b4857a7a9d820b0456e0ef2e1bca393801153095cfb34e0d50930157056ssdeep: 192:jkY0uPfqRC1uuB2R8BsISnlzEl8eA9kYbVdPw3Ew1MqO0QNmL:jztfqRbvR8BsV/V9kSVdPry00Qwtype: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Version Info:
Translation: 0x0000 0x04b0LegalCopyright: Copyright xa9  2015Assembly Version: 1.3.2.0InternalName: Sanction Ransom.exeFileVersion: 1.3.2.0CompanyName: Sanction RansomLegalTrademarks: Sanction RansomComments: Sanction RansomProductName: Sanction RansomProductVersion: 1.3.2.0FileDescription: Sanction RansomOriginalFilename: Sanction Ransom.exe

Ransom:Win32/RushCoin also known as:

K7AntiVirus	Trojan ( 004ddf631 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.4156
Cynet	Malicious (score: 99)
ALYac	Generic.Ransom.Hiddentear.A.BD69896F
Cylance	Unsafe
Zillya	Trojan.Crypren.Win32.257
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/generic.ali2000010
K7GW	Trojan ( 004ddf631 )
Cybereason	malicious.a50a1e
Symantec	Ransom.Sanction
ESET-NOD32	a variant of MSIL/Filecoder.AK
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Win32.Crypren.aclv
BitDefender	Generic.Ransom.Hiddentear.A.BD69896F
NANO-Antivirus	Trojan.Win32.Encoder.ebailg
MicroWorld-eScan	Generic.Ransom.Hiddentear.A.BD69896F
Tencent	Win32.Trojan.Raas.Auto
Ad-Aware	Generic.Ransom.Hiddentear.A.BD69896F
Sophos	Mal/Generic-R + Mal/Cryptear-A
Comodo	Malware@#xgq1j2miv823
BitDefenderTheta	Gen:NN.ZemsilF.34692.am0@aWAa0Zb
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom.MSIL.RUSHTEAR.AA
McAfee-GW-Edition	Ransomware-FTD!A50A9E1A50A1
FireEye	Generic.mg.a50a9e1a50a1eaec
Emsisoft	Generic.Ransom.Hiddentear.A.BD69896F (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Crypren.ao
Avira	HEUR/AGEN.1122521
Antiy-AVL	Trojan/Generic.ASMalwS.177BA38
Microsoft	Ransom:Win32/RushCoin
Arcabit	Generic.Ransom.Hiddentear.A.BDD11108F
AegisLab	Trojan.Win32.Crypren.j!c
GData	Generic.Ransom.Hiddentear.A.BD69896F
TACHYON	Ransom/W32.DN-Crypren.13824
AhnLab-V3	Trojan/Win32.Filecoder.C1365668
McAfee	Ransomware-FTD!A50A9E1A50A1
MAX	malware (ai score=100)
VBA32	Trojan.MSIL.gen.18
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom.MSIL.RUSHTEAR.AA
Rising	Ransom.RushCoin!1.BA8B (KTSE)
Yandex	Trojan.Crypren!YPCg0zeIaqg
Ikarus	Trojan.MSIL.Filecoder
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Filecoder.Y!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml