Categories: Ransom

How to remove “Ransom:Win32/SporaCrypt.PAD!MTB”?

The Ransom:Win32/SporaCrypt.PAD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/SporaCrypt.PAD!MTB virus can do?

Uses Windows utilities to enumerate running processes
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Detects Bochs through the presence of a registry key
Checks the version of Bios, possibly for anti-virtualization
Checks the CPU name from registry, possibly for anti-virtualization
Accessed credential storage registry keys
Collects information to fingerprint the system
Uses suspicious command line tools or Windows utilities

How to determine Ransom:Win32/SporaCrypt.PAD!MTB?


File Info:
name: EE21B4883A344A8648F0.mlwpath: /opt/CAPEv2/storage/binaries/a7a6ac83d928890eece7c9e89515ef6886a45f2801afba9bc6b6a5f72b6f335bcrc32: D89A7F61md5: ee21b4883a344a8648f061b8d0e6f62csha1: 27e6c8b46aab063f555445f8d84328977f80a9bfsha256: a7a6ac83d928890eece7c9e89515ef6886a45f2801afba9bc6b6a5f72b6f335bsha512: a3413083e21b565d45fd626ad452efcfe15a79e027f3a23adcdc2e852c26f5e072b12728b06da3ea1e2b7d337f471c7951517b0ecbe4c92634e816911104353fssdeep: 24576:+pF3468kI9BMItRlrmlaQRSSOrmkHDPFpVSZzihCwBRtSuaf:M4hk2RMRSSOiaPdSZzihFBRtSu4type: PE32 executable (console) Intel 80386, for MS Windowstlsh: T17F459D31B692D036F96101F05EB8FBAA552DFC254F3946CB77D41A2E6A305C20E32E67sha3_384: 153be7ec5ebe4f4a3096220d7642ef42b710bb4d9f02cec93dba6b0df8ae9315663a0ceeaf33f55edcf316b6cb4fe9aeep_bytes: e8f20c0000e974feffffcccccccccc80timestamp: 2022-08-26 11:44:31
Version Info:
0: [No Data]

Ransom:Win32/SporaCrypt.PAD!MTB also known as:

Lionic	Trojan.Win32.Generic.j!c
MicroWorld-eScan	DeepScan:Generic.Ransom.Spora.D292F861
FireEye	Generic.mg.ee21b4883a344a86
ALYac	Trojan.Ransom.VoidCrypt
Cylance	Unsafe
VIPRE	DeepScan:Generic.Ransom.Spora.D292F861
Sangfor	Ransom.Win32.Filecoder.Vd05
K7AntiVirus	Trojan ( 0058fa831 )
Alibaba	Ransom:Win32/Filecoder.9810d8e8
K7GW	Trojan ( 0058fa831 )
Cybereason	malicious.83a344
Cyren	W32/ABRisk.RULB-2288
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Filecoder.OIF
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Ransom.Win32.Generic
BitDefender	DeepScan:Generic.Ransom.Spora.D292F861
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Filecoder.Jflw
Ad-Aware	DeepScan:Generic.Ransom.Spora.D292F861
Emsisoft	DeepScan:Generic.Ransom.Spora.D292F861 (B)
DrWeb	Trojan.Siggen18.42020
TrendMicro	TROJ_GEN.R011C0WI422
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Sophos	Mal/Generic-S
Jiangmin	Trojan.DelShad.brc
Google	Detected
Avira	TR/FileCoder.drydq
Antiy-AVL	Trojan/Generic.ASMalwS.1D6F
Microsoft	Ransom:Win32/SporaCrypt.PAD!MTB
Arcabit	DeepScan:Generic.Ransom.Spora.D292F861
GData	DeepScan:Generic.Ransom.Spora.D292F861
Cynet	Malicious (score: 100)
McAfee	Artemis!EE21B4883A34
MAX	malware (ai score=88)
VBA32	BScope.Exploit.Convagent
TrendMicro-HouseCall	TROJ_GEN.R011C0WI422
Rising	Ransom.RCRU!1.DDE5 (CLASSIC)
Ikarus	Trojan-Ransom.FileCrypter
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Filecoder.OIE!tr.ransom
BitDefenderTheta	Gen:NN.ZexaF.34646.hvW@aW7aoBli
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)