Ransom

Ransom:Win32/StopCrypt.PAC!MTB removal tips

Malware Removal

The Ransom:Win32/StopCrypt.PAC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom:Win32/StopCrypt.PAC!MTB virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Ransom:Win32/StopCrypt.PAC!MTB?



File Info:

name: ADA004029A104E68183B.mlw
path: /opt/CAPEv2/storage/binaries/6212384e83d2bfd97c5871f42ab6a3a3b90ec00a78e93541cfdc76f038ad1b8a
crc32: B6380279
md5: ada004029a104e68183bb38d8a270408
sha1: 3b2b5dbcf9d71327aab0dce552f42b56e0b1e09d
sha256: 6212384e83d2bfd97c5871f42ab6a3a3b90ec00a78e93541cfdc76f038ad1b8a
sha512: 8edb4373b887778164075e0ad9b4f025f429665b083f22f3d65a0af3d2f19c6f869cf1b6580056d22d2c67ce2f436dc5cb9b9f24a374805e6de0d90333cb9133
ssdeep: 12288:/OvofQeeJZO7IO7IO7IO7IO7IO7IO7IO7IO7IO7IO7IO7IO7IO7IO7IO7IO7IO7y:SofQ1P
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B4B66AC1A2E25534F1E23E3186754BE44E3BBD52E820955A7230E7CF6BB75C1E90EB12
sha3_384: a1189e1ccbfb247c17667a8d4cc2654881f07f197a3a18f9cbaf16a8c81e2e631ab67ea8c6753850f477f6f903ad43fb
ep_bytes: e8952b0000e979feffff8bff558bec8b
timestamp: 2021-01-02 12:55:43


Version Info:

InternationalName: bomgvioci.iwa
Copyright: Copyrighz (C) 2021, fudkort
ProjectVersion: 3.14.72.77
Translation: 0x0129 0x07bc

Ransom:Win32/StopCrypt.PAC!MTB also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Jaik.4!c
Elasticmalicious (high confidence)
ClamAVWin.Dropper.Lockbit-9917808-0
CAT-QuickHealTrojan.ConvagenPMF.S25795269
McAfeeLockbit-FSWW!ADA004029A10
CylanceUnsafe
SangforRansom.Win32.StopCrypt.PAC!MTB
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderGen:Variant.Jaik.49991
K7GWRiskware ( 0040eff71 )
CrowdStrikewin/malicious_confidence_100% (W)
CyrenW32/Kryptik.FWV.gen!Eldorado
ESET-NOD32a variant of Win32/Kryptik.HNVH
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
AlibabaRansom:Win32/StopCrypt.1c061915
MicroWorld-eScanGen:Variant.Jaik.49991
Ad-AwareGen:Variant.Jaik.49991
SophosML/PE-A + Mal/Agent-AWV
DrWebTrojan.PWS.Stealer.31749
ZillyaTrojan.Kryptik.Win32.3665149
TrendMicroMal_Tofsee
McAfee-GW-EditionBehavesLike.Win32.Generic.vh
FireEyeGeneric.mg.ada004029a104e68
EmsisoftGen:Variant.Jaik.49991 (B)
IkarusTrojan-Ransom.StopCrypt
GDataGen:Variant.Jaik.49991
JiangminBackdoor.Tofsee.fit
MAXmalware (ai score=86)
Antiy-AVLTrojan/Generic.ASMalwS.34FF96C
GridinsoftRansom.Win32.STOP.sa
ArcabitTrojan.Jaik.DC347
MicrosoftRansom:Win32/StopCrypt.PAC!MTB
AhnLab-V3Ransomware/Win.Tofsee.C4899763
Acronissuspicious
VBA32BScope.Trojan.Agent
ALYacGen:Variant.Jaik.49991
TACHYONTrojan/W32.Agent.10485760.AZ
MalwarebytesMalware.AI.393240895
TrendMicro-HouseCallMal_Tofsee
RisingTrojan.Kryptik!8.8 (CLOUD)
YandexTrojan.Kryptik!uFWq23Srw3c
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/GenKryptik.ERHN!tr
Cybereasonmalicious.cf9d71
PandaTrj/Genetic.gen

How to remove Ransom:Win32/StopCrypt.PAC!MTB?

Ransom:Win32/StopCrypt.PAC!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment