Ransom

Ransom:Win32/StopCrypt.SAK!MTB removal guide

Malware Removal

The Ransom:Win32/StopCrypt.SAK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Ransom:Win32/StopCrypt.SAK!MTB virus can do?

  • Sample contains Overlay data
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Ransom:Win32/StopCrypt.SAK!MTB?


File Info:

name: 1EF3B2700826BF932A3C.mlw
path: /opt/CAPEv2/storage/binaries/c835934b46665ea57e33cb8d69a18b703dc08aaa3526fd2e8a5516a70e156a60
crc32: E8A646F9
md5: 1ef3b2700826bf932a3c0a921c283aff
sha1: 3896313e3a024184410e7d913bb81e3717f95188
sha256: c835934b46665ea57e33cb8d69a18b703dc08aaa3526fd2e8a5516a70e156a60
sha512: c2747871f074b68e2b8a17fe70b47bf60473de389ff358cad67470758ef902c61912ae02b55d794d5e1c2f372c7c7eec1f6b2a1c4acb80e96ed718367ef115de
ssdeep: 1536:Q0gbBy+kUDb2UQPyN4LFU8FUpXGzjqkb4EjPe0Bx2J9P+G32/:QR0YoyCLzFDiAkT32/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T161739E217980C072C58A25715478DBA65FBAA43217358D8B7BB52BBF4F307E2527A30B
sha3_384: c4996cad8b5ec6feeab884623e0c0cca4896b339eb9d95ea79dc0f170d9adc470dff1513a61664feea5ef6a3feec02d3
ep_bytes: e801400000e979feffff83252404b802
timestamp: 2022-05-31 08:08:21

Version Info:

0: [No Data]

Ransom:Win32/StopCrypt.SAK!MTB also known as:

BkavW32.AIDetectNet.01
LionicTrojan.Win32.SmartFortress.lEDV
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.65673989
FireEyeGeneric.mg.1ef3b2700826bf93
CAT-QuickHealTrojan.GenericRI.S30089922
McAfeeArtemis!1EF3B2700826
MalwarebytesMalware.AI.1533057345
ZillyaTrojan.Convagent.Win32.12259
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 00516fdf1 )
AlibabaTrojan:Application/Kryptik.75bbbf65
K7GWTrojan ( 00516fdf1 )
CrowdStrikewin/malicious_confidence_100% (W)
ArcabitTrojan.Generic.D3EA1B05
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win32/Kryptik.HSVP
APEXMalicious
Paloaltogeneric.ml
BitDefenderTrojan.GenericKD.65673989
SophosMal/Generic-S
DrWebTrojan.PWS.Stealer.35178
VIPRETrojan.GenericKD.65673989
TrendMicroTROJ_GEN.R002C0DBS23
McAfee-GW-EditionPacked-GEE!1EF3B2700826
Trapminemalicious.high.ml.score
EmsisoftTrojan.GenericKD.65673989 (B)
SentinelOneStatic AI – Suspicious PE
GoogleDetected
Antiy-AVLTrojan/MSIL.Convagent
MicrosoftRansom:Win32/StopCrypt.SAK!MTB
GDataTrojan.GenericKD.65673989
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.R560226
Acronissuspicious
ALYacTrojan.GenericKD.65673989
MAXmalware (ai score=84)
PandaTrj/Chgt.AD
TrendMicro-HouseCallTROJ_GEN.R002C0DBS23
RisingTrojan.Kryptik!1.E2E3 (CLASSIC)
IkarusTrojan-Ransom.StopCrypt
FortinetW32/Kryptik.HSVQ!tr
DeepInstinctMALICIOUS

How to remove Ransom:Win32/StopCrypt.SAK!MTB?

Ransom:Win32/StopCrypt.SAK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment