Categories: Ransom

What is “Ransom:Win32/StopCrypt.PAL!MTB”?

The Ransom:Win32/StopCrypt.PAL!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/StopCrypt.PAL!MTB virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Dynamic (imported) function loading detected
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Detects Sandboxie through the presence of a library
Detects Avast Antivirus through the presence of a library
Checks the presence of disk drives in the registry, possibly for anti-virtualization

How to determine Ransom:Win32/StopCrypt.PAL!MTB?


File Info:
name: C27CB9F099A10EDD36F7.mlwpath: /opt/CAPEv2/storage/binaries/cda99197b2854c18d78481e73154283deba14487e1d533fb701c49aad7cbb551crc32: CFF22678md5: c27cb9f099a10edd36f73e9fe38a2cd8sha1: bf12e9b07737a2ddfda148a55fd3605ab377a39dsha256: cda99197b2854c18d78481e73154283deba14487e1d533fb701c49aad7cbb551sha512: a0aaa045820d90f2c60fb8bff585555250ee0f0e39fc759089022e1164dbd259b10d5e88ffb9f210e27076349f84de83aa861523fe58749b8f52bcf66afb649essdeep: 3072:VtLhlA1N74MO2gM1Mzz8ub0NKkibj3t90oPrhs:VtLhlA1xB2rokbf2type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11054BF123AE0C832C7B75DB44474CFA56E7FF9125A61810F27681BEE2F732905A26387sha3_384: 9c64db6a05c78cbad301edd15239e8b10537a1b1a5a239ea6a6ab5ef3b0756f63ab1c9819896e1f5a5db6f5cba49c4baep_bytes: e8f1300000e979feffffe83700000086timestamp: 2020-12-14 05:07:26
Version Info:
InternationalName: bomgvioci.iwaCopyright: Copyrighz (C) 2021, fudkortProjectVersion: 3.14.70.27Translation: 0x0129 0x0794

Ransom:Win32/StopCrypt.PAL!MTB also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.82149
FireEye	Generic.mg.c27cb9f099a10edd
CAT-QuickHeal	Trojan.SabsikPMF.S26051341
ALYac	Trojan.GenericKDZ.82149
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/StopCrypt.2b308277
K7GW	Trojan ( 0058cc3f1 )
K7AntiVirus	Trojan ( 0058cc0e1 )
Cyren	W32/Kryptik.FWV.gen!Eldorado
Symantec	Packed.Generic.525
ESET-NOD32	a variant of Win32/Kryptik.HNXU
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender	Trojan.GenericKDZ.82149
Avast	Win32:CrypterX-gen [Trj]
Ad-Aware	Trojan.GenericKDZ.82149
Emsisoft	Trojan.Crypt (A)
DrWeb	Trojan.Siggen16.28364
TrendMicro	TROJ_GEN.R002C0PA822
McAfee-GW-Edition	BehavesLike.Win32.Generic.dt
Sophos	Mal/Generic-R + Mal/Agent-AWV
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.BSE.16VOW5Z
Jiangmin	TrojanSpy.Stealer.mrr
MAX	malware (ai score=80)
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Ransom:Win32/StopCrypt.PAL!MTB
AhnLab-V3	Infostealer/Win.Raccoon.R463105
Acronis	suspicious
McAfee	GenericRXAA-AA!C27CB9F099A1
VBA32	BScope.Trojan.Convagent
Malwarebytes	Trojan.MalPack.GS
TrendMicro-HouseCall	TROJ_GEN.R002C0PA822
Rising	Trojan.Generic@AI.90 (RDMK:r8JQdZ+hOfJBTcJTGKFoNg)
Yandex	Trojan.Kryptik!S3MV50tDAWU
Ikarus	Trojan.Win32.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.ERHN!tr
BitDefenderTheta	Gen:NN.ZexaF.34160.ruW@a8Oi4ukK
AVG	Win32:CrypterX-gen [Trj]
Panda	Trj/GdSda.A