About “Ransom:Win32/StopCrypt.SF!MTB” infection

The Ransom:Win32/StopCrypt.SF!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:Win32/StopCrypt.SF!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Georgian
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the Tofsee malware family
• Deletes executed files from disk
• Attempts to interact with an Alternate Data Stream (ADS)
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities

How to determine Ransom:Win32/StopCrypt.SF!MTB?

File Info:
name: 7E7E4DC4643825C59181.mlw
path: /opt/CAPEv2/storage/binaries/394343e162cde20e8453fcdd5e3ce14ac0b6893a25fe4f7d23e6f3d10a2f925e
crc32: 53B74222
md5: 7e7e4dc4643825c59181445d03c63c27
sha1: b44bb464a1ecb92b8f9b87bdc110054c4b0d3968
sha256: 394343e162cde20e8453fcdd5e3ce14ac0b6893a25fe4f7d23e6f3d10a2f925e
sha512: 7a866bda2001b039918728727eb79946f41a85e05de4b562747c6b93880cc57faa669fa131e3aab974f95769d959b2fb7cde2b22990c6aa42de01cf4855128af
ssdeep: 3072:8jRqKNFWoqlNrDW65LawqY1rvylE6FlKzGrRu542Pv:Cq9N3tJ1rvKE6/SGrR12
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CDB63A3386B64425D2F5F63E729E3B60CFBD98BA83E4A6F6D21004D4853265B50ED84F
sha3_384: bc2f79cde4e93fb265d388bfa139e95edd663f600489c0e0670dc659fb62972d47e65422271a0b57cfdf2531869dbe67
ep_bytes: e89a3e0000e978feffff8bff558bec83
timestamp: 2021-11-13 04:44:46

Version Info:
FileVersions: 9.1.9.3
Copyright: Copyright (C) 2022, somoklos
ProjectVersion: 74.35.66.25

Ransom:Win32/StopCrypt.SF!MTB also known as:

How to remove Ransom:Win32/StopCrypt.SF!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.