Ransom:Win32/StopCrypt.PAT!MTB information

The Ransom:Win32/StopCrypt.PAT!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/StopCrypt.PAT!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Queries information on disks, possibly for anti-virtualization
• Attempts to restart the guest VM
• Uses IOCTL_SCSI_PASS_THROUGH control codes to manipulate drive/MBR which may be indicative of a bootkit
• Spoofs its process name and/or associated pathname to appear as a legitimate process
• Attempted to write directly to a physical drive

How to determine Ransom:Win32/StopCrypt.PAT!MTB?

File Info:
name: EB4B02078CA9EDA9A3E3.mlw
path: /opt/CAPEv2/storage/binaries/149eef272d8562dac065e683ae78b9857a1abf4ae19f1cd01ea378bd7c24ee6f
crc32: 0A1A36AC
md5: eb4b02078ca9eda9a3e3bf9c1b527e49
sha1: c914336053eee60df961866fdc0d0bc806b79620
sha256: 149eef272d8562dac065e683ae78b9857a1abf4ae19f1cd01ea378bd7c24ee6f
sha512: 4a2a95b11b47c711aabb7d32b65a1bf6db0e922cf5aca4faad24eb0f1a98db870873237708b142268c63f3ddd07af5e0f9920e0e1f735124d2dc2a694fbbda2b
ssdeep: 12288:MlYUPqnfwnr4LrEva0IRQPPnRMM6R8CIb7:kLyGsLrvRQHRH6/I
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1ABD412D07A80F032D0497578842ACFE1EA7B7D92DD64CA373FB6132E4E396D09A5A711
sha3_384: 64c677c8ae4859388869fac6c5be7924790b04628754cc4390fc1dd17c19e2461ff63586501cfe2de91284a51afb79bf
ep_bytes: e84f420000e978feffffb810104100c3
timestamp: 2021-03-06 19:33:49

Version Info:
FileVersion: 21.29.11.69
InternationalName: bomgveoci.iwe
Copyright: Copyrighz (C) 2021, fudkorta
ProjectVersion: 1.10.70.57
Translations: 0x0121 0x03ca

Ransom:Win32/StopCrypt.PAT!MTB also known as:

How to remove Ransom:Win32/StopCrypt.PAT!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.