Should I remove “Ransom:Win32/StopCrypt.PBF!MTB”?

The Ransom:Win32/StopCrypt.PBF!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/StopCrypt.PBF!MTB virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Manipuri
• Authenticode signature is invalid
• CAPE detected the RedLine malware family
• Anomalous binary characteristics

How to determine Ransom:Win32/StopCrypt.PBF!MTB?

File Info:
name: 365F20A6960817BA2941.mlw
path: /opt/CAPEv2/storage/binaries/d887b77bd661b078b13d8820cdf35d0917e6d15d978c1d90b0bed75d9c123409
crc32: F8F7ED86
md5: 365f20a6960817ba2941fcffba506c64
sha1: 9b3793b5163d6f8aa2d23e0e4cb6e93b05c9f351
sha256: d887b77bd661b078b13d8820cdf35d0917e6d15d978c1d90b0bed75d9c123409
sha512: e79bc5c93e81a735a8b6f6e788d80e758817071f9d4fd860cd7678f056fc5bcffe15f48288ff848d7d86f51d192b3319c5b066760b1e9dd33d54e9dbc50f0800
ssdeep: 6144:NXNGF9bkXwFqVQccX1lwwcZO8SGz94tmYKcv9OdnpD42s+bS:NXNG/kAFqVuTwwcE8x9gmYxcpQh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E594F113B990C433E66649717896D7749E7BB8301A30568B7BA4467C8F313E2EE7930A
sha3_384: 6017b741dc15372b6bccc221c643901b69d09512f531fcc3e01c2242ff90867cedcdd91af07a85aa8a5d7411c8aa5d52
ep_bytes: e884590000e978feffff8bff558bec8b
timestamp: 2020-11-02 13:32:15

Version Info:
FileVersion: 34.42.11.13
Copyrighz: Copyright (C) 2022, fuzkarte
ProjectVersion: 5.13.85.11

Ransom:Win32/StopCrypt.PBF!MTB also known as:

How to remove Ransom:Win32/StopCrypt.PBF!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.