Categories: Ransom

Ransom:Win32/StopCrypt.SAI!MTB removal

The Ransom:Win32/StopCrypt.SAI!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/StopCrypt.SAI!MTB virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Saami
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Ransom:Win32/StopCrypt.SAI!MTB?


File Info:
name: 669A53D272A0C5C04DD5.mlwpath: /opt/CAPEv2/storage/binaries/0ed328ff7c377e7d6be8dc5ed8ac1ab8310762a05afafef0bef4450e9ee1a4f3crc32: 9AAA6261md5: 669a53d272a0c5c04dd5c5d019aaaa31sha1: 9a915471d94f77f5543f33f2c17a5c7423e8dcc7sha256: 0ed328ff7c377e7d6be8dc5ed8ac1ab8310762a05afafef0bef4450e9ee1a4f3sha512: d986c5e556d32b76471a82a7d575f9058ca0ca1dcd05391dfe019c2e42cf5507133ba6cab3cb2733f8fd17e7a6c33e5379bdd66b058cbcec653b08056522bacdssdeep: 98304:ZMw89dDHo905jMrug3PUt9ABTj0MXl6hn3tNptCzFOkHIhd:ZMtdDI9GMqsstGdj0MUVOPIztype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14736333637D8B566F53013315C34D7AA1D98BC674A36E1CF62846B6B28F04A0EDF2B52sha3_384: 014b362c9e7a218be285eda5071f70438ecac9068ef9fa938f27a83faf09a2715864f2ca5e3e8a80b783df51992b42ecep_bytes: e8e4420000e989feffff8bff558bec8btimestamp: 2021-12-06 21:45:16
Version Info:
CompanyName: PakistanFoodFileDescription: MorriconeFileVersion: 78.57.24.63InternalName: FamousOnce.exeLegalTrademarks1: consultatedProductName: TableListTranslation: 0x4048 0x0564

Ransom:Win32/StopCrypt.SAI!MTB also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
DrWeb	Trojan.PWS.Stealer.35178
MicroWorld-eScan	Gen:Variant.Zusy.451743
ClamAV	Win.Packed.Tofsee-9989701-0
ALYac	Gen:Variant.Zusy.451743
Malwarebytes	Trojan.MalPack.GS
VIPRE	Gen:Variant.Zusy.451743
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Zenpak.b4894f74
K7GW	Trojan ( 0059f7cb1 )
Cybereason	malicious.1d94f7
Cyren	W32/Agent.FRF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HSXD
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Zenpak.pef
BitDefender	Gen:Variant.Zusy.451743
NANO-Antivirus	Trojan.Win32.Zenpak.jvdboa
Avast	Win32:PWSX-gen [Trj]
Tencent	Trojan.Win32.Obfuscated.gen
Emsisoft	Gen:Variant.Zusy.451743 (B)
F-Secure	Heuristic.HEUR/AGEN.1310247
TrendMicro	Ransom_StopCrypt.R002C0DC323
McAfee-GW-Edition	BehavesLike.Win32.Lockbit.rc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.669a53d272a0c5c0
Sophos	Troj/Krypt-VE
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Zusy.451743
Avira	HEUR/AGEN.1310247
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Win32.Sabsik
Arcabit	Trojan.Zusy.D6E49F
ViRobot	Trojan.Win32.LockBit.199680
ZoneAlarm	HEUR:Trojan.Win32.Zenpak.pef
Microsoft	Ransom:Win32/StopCrypt.SAI!MTB
Google	Detected
AhnLab-V3	Ransomware/Win.Generic.R560818
McAfee	Artemis!669A53D272A0
VBA32	BScope.Trojan.CoinMiner
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom_StopCrypt.R002C0DC323
Rising	Trojan.Kryptik!1.E349 (CLASSIC)
Yandex	Trojan.Kryptik!fWHWWh3idnA
Ikarus	Trojan.Win32.Crypt
MaxSecure	Backdoor.W32.Mokes.gen
Fortinet	W32/Kryptik.HSXB!tr
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)