About “Ransom:Win32/StopCrypt.PBD!MTB” infection

The Ransom:Win32/StopCrypt.PBD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/StopCrypt.PBD!MTB virus can do?

Unconventionial language used in binary resources: Uzbek (Latin)
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Ransom:Win32/StopCrypt.PBD!MTB?


File Info:
name: 620837FE1D520B855C37.mlw
path: /opt/CAPEv2/storage/binaries/2c5268cdd29f95e4794331e5a97ec4b25c1609407c94d0189ea1fbfbbe86244c
crc32: 01B3D7F0
md5: 620837fe1d520b855c37f885ac76e40c
sha1: 4ea14e6ed3086bc38dbfc2a5e305dbed38afdfcf
sha256: 2c5268cdd29f95e4794331e5a97ec4b25c1609407c94d0189ea1fbfbbe86244c
sha512: 7c424cfeec3e997087ab61f8f1e13ccfc567121b22873cb7c853e0d2a20588423294d05b9b2cb354828d3341ff77ac0dca1eaaedb212eacad78f0e6ba61e21d7
ssdeep: 12288:G3+lB/Z2zL7g+0ZMzwi7777777777777777777777777P:GWo8+XT
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15225AE4073D1EC66E3B195B04939A3F4253AB872972A66CB27483E4B7C32391EE71753
sha3_384: ad02abab4ea6b0e92bb3abb2398af09a262048294cafef9ea9e09b746065eb88fb676fc82785d08fb94004f6f5478223
ep_bytes: 8bff558bece8c6920000e8110000005d
timestamp: 2021-06-03 15:24:55

Version Info:
Translations: 0x0027 0x0306

Ransom:Win32/StopCrypt.PBD!MTB also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader44.48156
Cynet	Malicious (score: 100)
FireEye	Generic.mg.620837fe1d520b85
CAT-QuickHeal	Ransom.StopcryptPMF.S27330451
ALYac	Gen:Heur.Mint.Zard.52
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
K7GW	Trojan ( 005903821 )
K7AntiVirus	Trojan ( 005903821 )
Cyren	W32/Kryptik.GIY.gen!Eldorado
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.HPBK
ClamAV	Win.Packed.Ransomx-9942692-0
BitDefender	Gen:Heur.Mint.Zard.52
MicroWorld-eScan	Gen:Heur.Mint.Zard.52
Tencent	Trojan-Ransom.Win32.Stop.16000389
Ad-Aware	Gen:Heur.Mint.Zard.52
Emsisoft	Trojan.Crypt (A)
Zillya	Trojan.Kryptik.Win32.3729668
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Sophos	ML/PE-A + Troj/Krypt-FV
Ikarus	Trojan.Win32.Crypt
GData	Win32.Trojan.PSE.1DYKG7E
Jiangmin	Backdoor.Tofsee.fpa
Arcabit	Trojan.Mint.Zard.52
Microsoft	Ransom:Win32/StopCrypt.PBD!MTB
SentinelOne	Static AI – Malicious PE
AhnLab-V3	Packed/Win.GEE.R481237
Acronis	suspicious
McAfee	Packed-GEE!620837FE1D52
VBA32	TrojanSpy.Stealer
Malwarebytes	Malware.AI.2754436744
APEX	Malicious
Rising	Malware.Obscure!1.A3BB (C64:YzY0Ovp/LwnkEaJq)
Yandex	Trojan.Kryptik!qNX5xizix+g
MAX	malware (ai score=88)
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/GenericKDZ.DAED!tr
Cybereason	malicious.ed3086
Panda	Trj/Genetic.gen

How to remove Ransom:Win32/StopCrypt.PBD!MTB?

Ransom:Win32/StopCrypt.PBD!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X