Ransom:Win32/StopCrypt.PAJ!MTB removal guide

The Ransom:Win32/StopCrypt.PAJ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/StopCrypt.PAJ!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Spanish (Argentina)
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• Network activity contains more than one unique useragent.
• CAPE detected the OnlyLogger malware family
• Attempts to modify proxy settings
• Uses suspicious command line tools or Windows utilities

How to determine Ransom:Win32/StopCrypt.PAJ!MTB?

File Info:
name: 1D64AAA3D425237BE4BC.mlw
path: /opt/CAPEv2/storage/binaries/be381beb3435877071156380452d9ff94d519f7147e953864675c6b882649ea7
crc32: 7DE65B8E
md5: 1d64aaa3d425237be4bcb3619fe3e8ae
sha1: 37f766b56bc88dcd9d6857b4237260f2a9a7bf25
sha256: be381beb3435877071156380452d9ff94d519f7147e953864675c6b882649ea7
sha512: ddde0052395b5c1cfe2639c5057f2729a81bc601e10c27b36e55f9f6206d984d199b4714e6e5803f81e1ef5b095a8fc973a89356ba23c40b9475e51d34d35d53
ssdeep: 6144:fWysLP0scx+vxD/kBe+lE5Q0fcdpaHe44kqBp9Fuzbgwu:I4sO0/kMkkHe44LBp9Funn
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B884DF313ADCC471C69312308860CBA55F7AF8216D7295C777A5376E1E30AEC9AF221E
sha3_384: 2d79051d95fb6dee0a4e3bc3ba544da98ac3f51d59494cdde049ec477292c9dde5efccf8b40d88723736f17fe5b44c0a
ep_bytes: e876570000e979feffffcccccccccccc
timestamp: 2021-03-16 21:57:50

Version Info:
InternationalName: bomgvioci.iwa
Copyright: Copyrighz (C) 2021, fudkort
ProjectVersion: 3.10.70.17
Translation: 0x0129 0x0794

Ransom:Win32/StopCrypt.PAJ!MTB also known as:

How to remove Ransom:Win32/StopCrypt.PAJ!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.