Ransom

Should I remove “Ransom:Win32/StopCrypt.PAZ!MTB”?

Malware Removal

The Ransom:Win32/StopCrypt.PAZ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Ransom:Win32/StopCrypt.PAZ!MTB virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Enumerates the modules from a process (may be used to locate base addresses in process injection)
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the RedLine malware family
  • Anomalous binary characteristics

How to determine Ransom:Win32/StopCrypt.PAZ!MTB?


File Info:

name: A82F7269C18AB19DCD04.mlw
path: /opt/CAPEv2/storage/binaries/311765b2caff164366cafae3897334eb627fce1ced314daedab2b271cedf8381
crc32: BECD3928
md5: a82f7269c18ab19dcd049620cd180542
sha1: a5a96eb4a5af62c4072be19fc1fac3e6e7d98be3
sha256: 311765b2caff164366cafae3897334eb627fce1ced314daedab2b271cedf8381
sha512: c1cbfd78fd45d2fadf3a403420df30b6656ef372cd7fcfe161d36449bb92f50eccbcf6ca0aedd1167ea98a7725ae8df198238fa4627c59925f44d598e58b9409
ssdeep: 6144:AMcQil1aGe3T185Log7JhphEEvSDz2Nii9I7ITsqIzNY:FcpUGMT+5LUF97xzNY
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DA84F1D67A90C431C4827C3588B1DFA15F7EB921DBB1450B3779166EAF703E17B2A20A
sha3_384: c565529b80522d20b002a540344694d91f0370380461845a0e7d902733d07778b6c82292786ce0ebe05fcda917765a8d
ep_bytes: e865340000e978feffff8bff558bec8b
timestamp: 2021-08-30 05:34:37

Version Info:

FileVersion: 21.79.127.9
InternationalName: povgwaoci.iwe
Copyrighz: Copyrighz (C) 2022, fuzkorta
Translations: 0x0129 0x010f

Ransom:Win32/StopCrypt.PAZ!MTB also known as:

BkavW32.AIDetect.malware2
tehtrisGeneric.Malware
MicroWorld-eScanGen:Variant.Babar.32941
CAT-QuickHealBackdoor.MokesRI.S26860814
ALYacGen:Variant.Babar.32941
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusSpyware ( 0056acbc1 )
AlibabaRansom:Win32/StopCrypt.f77ad44c
K7GWSpyware ( 0056acbc1 )
CyrenW32/Kryptik.GGR.gen!Eldorado
Elasticmalicious (high confidence)
ESET-NOD32MSIL/Spy.Agent.CVT
APEXMalicious
ClamAVWin.Malware.Filerepmalware-9940328-0
KasperskyHEUR:Trojan-Spy.Win32.Stealer.gen
BitDefenderGen:Variant.Babar.32941
NANO-AntivirusTrojan.Win32.Stealer.joehln
AvastWin32:AceCrypter-I [Cryp]
TencentWin32.Trojan.Falsesign.Llhf
Ad-AwareGen:Variant.Babar.32941
SophosML/PE-A + Mal/Agent-AWV
ComodoMalware@#1negiot8uryn0
DrWebTrojan.PWS.Siggen3.12204
ZillyaTrojan.Agent.Win32.2764746
TrendMicroRansom_StopCrypt.R003C0DD722
McAfee-GW-EditionPacked-GDT!A82F7269C18A
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.a82f7269c18ab19d
EmsisoftGen:Variant.Babar.32941 (B)
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Babar.32941
JiangminBackdoor.Mokes.fig
AviraTR/Spy.Agent.ikzfg
MAXmalware (ai score=86)
MicrosoftRansom:Win32/StopCrypt.PAZ!MTB
CynetMalicious (score: 100)
AhnLab-V3Packed/Win.GEE.R475104
McAfeePacked-GDT!A82F7269C18A
VBA32BScope.Malware-Cryptor.Hlux
MalwarebytesTrojan.MalPack.GS
TrendMicro-HouseCallRansom_StopCrypt.R003C0DD722
RisingTrojan.Kryptik!1.DC53 (CLASSIC)
YandexTrojanSpy.Agent!2UVL8bwjh6c
IkarusTrojan-Spy.MSIL.Agent
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GenericKDZ.B41B!tr
AVGWin32:AceCrypter-I [Cryp]
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Ransom:Win32/StopCrypt.PAZ!MTB?

Ransom:Win32/StopCrypt.PAZ!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment