What is “Ransom:Win32/Stopcrypt.YAI!MTB”?

The Ransom:Win32/Stopcrypt.YAI!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/Stopcrypt.YAI!MTB virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Ransom:Win32/Stopcrypt.YAI!MTB?


File Info:
name: 787EC843FDB922D7A185.mlw
path: /opt/CAPEv2/storage/binaries/7c97d51ae017d3d861b316ac11b84763fb4ca8d16b93728408f59ab700eaf678
crc32: A842FF4E
md5: 787ec843fdb922d7a18522fdf5680411
sha1: ffa0200b15ed15b948fd31a2a54fe8186a02b72c
sha256: 7c97d51ae017d3d861b316ac11b84763fb4ca8d16b93728408f59ab700eaf678
sha512: 2b7770a67f08b1a1e71d2e7824b5aa895fa05aeb67479b61ffa0ca4f8b0bb3dbd0d51310e71f9a248f48ebccc9f4892400cc86246c28ba32ef70dc2c27ad97c6
ssdeep: 1536:TuW6AMvAuC+7oQUmLj353zIcUx0qeg6KnMw:TuWzsQ1QddIJR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T181A3AD3176D0C033D4A37530147186A26FBE69322BB5A4CB5B6819392FB07D16B7D3AB
sha3_384: 2ece895bcc51b96dfe25df35add01733cdbc648571dc63faeb65bc771f09763e097f769d3eae4444af355083a7e23c69
ep_bytes: e8d2430000e989feffff8bff558bec51
timestamp: 2022-01-25 11:25:45

Version Info:
0: [No Data]

Ransom:Win32/Stopcrypt.YAI!MTB also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader45.61873
MicroWorld-eScan	Trojan.GenericKDZ.101988
FireEye	Generic.mg.787ec843fdb922d7
CAT-QuickHeal	Trojan.Inject.22252
ALYac	Trojan.GenericKDZ.101988
Malwarebytes	Malware.AI.3372648441
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
APEX	Malicious
BitDefender	Trojan.GenericKDZ.101988
Rising	Trojan.Kryptik!1.E892 (CLASSIC)
Sophos	ML/PE-A
VIPRE	Trojan.GenericKDZ.101988
McAfee-GW-Edition	BehavesLike.Win32.Generic.nm
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKDZ.101988 (B)
GData	Trojan.GenericKDZ.101988
Arcabit	Trojan.Generic.D18E64
Microsoft	Ransom:Win32/Stopcrypt.YAI!MTB
Cynet	Malicious (score: 100)
McAfee	Artemis!787EC843FDB9
MAX	malware (ai score=82)
SentinelOne	Static AI – Suspicious PE
Cybereason	malicious.b15ed1
DeepInstinct	MALICIOUS

How to remove Ransom:Win32/Stopcrypt.YAI!MTB?

Ransom:Win32/Stopcrypt.YAI!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X