Ransom:Win32/StopCrypt.PCF!MTB removal guide

The Ransom:Win32/StopCrypt.PCF!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/StopCrypt.PCF!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Ransom:Win32/StopCrypt.PCF!MTB?


File Info:
name: BD3F6F1BA62FB0C0F235.mlw
path: /opt/CAPEv2/storage/binaries/97f810c5f21843c661ce9244e2083709f008a338a99c2cff1122d706a4e4e1b9
crc32: 73B7A261
md5: bd3f6f1ba62fb0c0f235aae982a4e2c7
sha1: 3baa263cb2d9f4c6eee4ee018c3781c25bd23f40
sha256: 97f810c5f21843c661ce9244e2083709f008a338a99c2cff1122d706a4e4e1b9
sha512: b85d0972ec88996ba872746101bf230dd37034145a8b09c17fb34d20610b600e70145f05b52c8c994525f5a57a9799e96163ee35e0eaa1e47ec5508f46b2d753
ssdeep: 1536:/ccNrU1SUO917MeBuZB4CTas8XlxU0LcFI3s:071SN9BMeB+GCWsAlxUAh8
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E3530A00ABF08035F6B75AF4997A43987A3E79D12B70D4CF429509EE0A35AE9DD7031B
sha3_384: e051b434e358b9701304d6ceec3ffb416c76dc805dacddc89b817ddaa2fa86de63adb16fdd6f025f3c40f43fc6013735
ep_bytes: 8bff558bece8b6690000e8110000005d
timestamp: 2021-09-28 22:28:22

Version Info:
0: [No Data]

Ransom:Win32/StopCrypt.PCF!MTB also known as:

Bkav	W32.AIDetect.malware1
MicroWorld-eScan	Trojan.GenericKDZ.90195
FireEye	Generic.mg.bd3f6f1ba62fb0c0
McAfee	Packed-GEE!BD3F6F1BA62F
VIPRE	Trojan.GenericKDZ.90195
Cyren	W32/Kryptik.HDC.gen!Eldorado
Elastic	malicious (moderate confidence)
APEX	Malicious
ClamAV	Win.Malware.Pwsx-9958590-0
BitDefender	Trojan.GenericKDZ.90195
Ad-Aware	Trojan.GenericKDZ.90195
Emsisoft	Trojan.GenericKDZ.90195 (B)
DrWeb	Trojan.PWS.Stealer.23680
McAfee-GW-Edition	Packed-GEE!BD3F6F1BA62F
Trapmine	malicious.moderate.ml.score
Sophos	Generic ML PUA (PUA)
GData	Trojan.GenericKDZ.90195
Microsoft	Ransom:Win32/StopCrypt.PCF!MTB
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKDZ.90195
MAX	malware (ai score=87)
Rising	Trojan.Generic@AI.83 (RDML:vuTPDgcVVElWT7+1FPlArA)
Ikarus	Trojan.SmokeLoader
Fortinet	W32/GenKryptik.FXZH!tr
CrowdStrike	win/malicious_confidence_60% (D)

How to remove Ransom:Win32/StopCrypt.PCF!MTB?

Ransom:Win32/StopCrypt.PCF!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X