About “Ransom:Win32/StopCrypt.MSK!MTB” infection

Malware Removal

The Ransom:Win32/StopCrypt.MSK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Ransom:Win32/StopCrypt.MSK!MTB virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • A process created a hidden window
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
api.2ip.ua
securebiz.org
tbpws.top

How to determine Ransom:Win32/StopCrypt.MSK!MTB?


File Info:

crc32: 03FB8866
md5: 686d32c7fc67fb1dfdc12aa7e9bdbcf5
name: 686D32C7FC67FB1DFDC12AA7E9BDBCF5.mlw
sha1: c4d52823365978859abfe639871d85136ad94d61
sha256: da7263588f95278e91f5ddb2898d18735d6c6abfa1e872d1358aafa4e044adca
sha512: 005563f15ae87958f5d8586df237951e6e149be017f291931b9eeee079cdb0d501707023dad0bbcfb2081677a095d6d56b63a2858ad32a59b87f32c553e81e3e
ssdeep: 12288:4zMYUnTf1EvkOsg9/OzWhBoc+0sutJyvt5HIHY2NcyF+vl0wIdWTKi:PYOTSLxf4LBgF+MO
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Ransom:Win32/StopCrypt.MSK!MTB also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
DrWebTrojan.DownLoader41.63105
ClamAVWin.Malware.Generic-9890141-0
CAT-QuickHealRansom.Stop.Z5
ALYacTrojan.GenericKDZ.77460
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
CyrenW32/Kryptik.EYC.gen!Eldorado
ESET-NOD32a variant of Win32/Kryptik.HMHX
APEXMalicious
AvastWin32:PWSX-gen [Trj]
CynetMalicious (score: 100)
KasperskyHEUR:Trojan-Ransom.Win32.Stop.gen
BitDefenderTrojan.GenericKDZ.77460
MicroWorld-eScanTrojan.GenericKDZ.77460
Ad-AwareTrojan.GenericKDZ.77460
SophosMal/Generic-S
BitDefenderThetaGen:NN.ZexaF.34126.VqW@aOhUoOlG
McAfee-GW-EditionBehavesLike.Win32.Emotet.bc
FireEyeGeneric.mg.686d32c7fc67fb1d
EmsisoftTrojan.GenericKDZ.77460 (B)
SentinelOneStatic AI – Malicious PE
AviraEXP/YAV.Minerva.pospj
eGambitUnsafe.AI_Score_71%
Antiy-AVLTrojan/Win32.Chapak
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftRansom:Win32/StopCrypt.MSK!MTB
ArcabitTrojan.Generic.D12E94
GDataTrojan.GenericKDZ.77460
AhnLab-V3Trojan/Win.MalPE.R440061
Acronissuspicious
McAfeePacked-GDT!686D32C7FC67
MAXmalware (ai score=81)
VBA32Trojan.Racoon
MalwarebytesTrojan.MalPack
PandaTrj/GdSda.A
RisingMalware.Obscure/Heur!1.A89F (CLASSIC)
IkarusTrojan.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GenKryptik.FJXI!tr
AVGWin32:PWSX-gen [Trj]
Paloaltogeneric.ml

How to remove Ransom:Win32/StopCrypt.MSK!MTB?

Ransom:Win32/StopCrypt.MSK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment