About “Ransom:Win32/Ryuk!MTB” infection

The Ransom:Win32/Ryuk!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/Ryuk!MTB virus can do?

Unconventionial language used in binary resources: Russian
Anomalous binary characteristics

How to determine Ransom:Win32/Ryuk!MTB?


File Info:
crc32: 648FA290
md5: 07ca772a3caf961eb132dab4d11d72fb
name: 07CA772A3CAF961EB132DAB4D11D72FB.mlw
sha1: 38c6d67fffae1c6d28fc284237a467eb84c889bc
sha256: 1f5ad0a99330274ec119de6dadebc55d02739b4d509d9b789e783ae2802e2136
sha512: 58803b8beb4257d9bbc4789dd131574884644318eefd5db9eb9649ba002c6156991669f3a37246d395c84960b61283458a929735339d5bdfba265671782f02b3
ssdeep: 3072:y7BrNEgNc6Ts37SxXbkdoiBGbCz6PGoFLo1OfSM2H9C3EI9KaNQP6rMWMPwCky8:c1NnNe77pNoFQ2Q96j3sWMIe8er+eZk
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Ransom:Win32/Ryuk!MTB also known as:

Bkav	W32.AIDetectGBM.malware.02
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.36388534
McAfee	Artemis!07CA772A3CAF
Sangfor	Trojan.Win32.Wacatac.B
CrowdStrike	win/malicious_confidence_90% (W)
BitDefender	Trojan.GenericKD.36388534
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Ryuk-A [Trj]
Alibaba	Ransom:Win32/Generic.21fbcc8f
AegisLab	Trojan.Win32.Generic.4!c
Rising	Trojan.Generic@ML.90 (RDML:8SOM34CBI49R/3Fk4y/k4g)
Ad-Aware	Trojan.GenericKD.36388534
Emsisoft	Trojan.GenericKD.36388534 (B)
McAfee-GW-Edition	BehavesLike.Win32.QJWMonkey.fm
FireEye	Generic.mg.07ca772a3caf961e
Sophos	ML/PE-A
Microsoft	Ransom:Win32/Ryuk!MTB
Arcabit	Trojan.Generic.D22B3EB6
GData	Trojan.GenericKD.36388534
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4342141
ALYac	Trojan.GenericKD.36388534
MAX	malware (ai score=89)
Malwarebytes	Malware.AI.4285869246
SentinelOne	Static AI – Suspicious PE
Fortinet	PossibleThreat.PALLAS.H
AVG	Win32:Ryuk-A [Trj]
Qihoo-360	Win32/Trojan.Generic.HgIASPQA

How to remove Ransom:Win32/Ryuk!MTB?

Ransom:Win32/Ryuk!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X