Ransom:Win32/StopCrypt.PCG!MTB (file analysis)

The Ransom:Win32/StopCrypt.PCG!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/StopCrypt.PCG!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Kannada
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the RedLine malware family
• Anomalous binary characteristics

How to determine Ransom:Win32/StopCrypt.PCG!MTB?

File Info:
name: ACAED85DE95645DAF3F1.mlw
path: /opt/CAPEv2/storage/binaries/61bb1fe158e6da9fcc22c4e91aeb29e07a1e0640aa3fcc7dca41df40b7c30709
crc32: AC55EC14
md5: acaed85de95645daf3f1b509799b0304
sha1: d4cc7474b8c4b7ddea0c26629fe5159b385a83cc
sha256: 61bb1fe158e6da9fcc22c4e91aeb29e07a1e0640aa3fcc7dca41df40b7c30709
sha512: d40b5ef679f51c212a848bb31118578ec3ec7ca9473bb8279dd02be354a292ace3ffdb299794f7b20a5ae1e5079877fa997a4788e32d89097da50f840ee7ec0c
ssdeep: 6144:7z21VoXIXiY2WxaAXDtLt48EnUgov06r4DfxCe3r/NigaSm:7Sooj48P1kCebYa
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12174E1127BE4C831E1635D306878D6619A3BBC43AB30858BF394672E2F317D16A79367
sha3_384: f446e27686e3fd552198b2432f57bce2131c16e37cbfe888d29954e0d95b6d858f910335d80e3ac4deb194d0991b9e1a
ep_bytes: e8a4490000e989feffffcccccccccccc
timestamp: 2021-10-28 02:56:48

Version Info:
FileVersions: 44.48.44.20
Copyrighz: Copyright (C) 2022, pozkarte
ProjectVersion: 85.41.5.33

Ransom:Win32/StopCrypt.PCG!MTB also known as:

How to remove Ransom:Win32/StopCrypt.PCG!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.