Ransom

Should I remove “Ransom:Win32/Taleb.PAA!MTB”?

Malware Removal

The Ransom:Win32/Taleb.PAA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Ransom:Win32/Taleb.PAA!MTB virus can do?

  • Attempts to connect to a dead IP:Port (1 unique times)
  • Starts servers listening on 127.0.0.1:0
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Performs some HTTP requests
  • Uses Windows utilities for basic functionality
  • Attempts to stop active services
  • Modifies boot configuration settings
  • Installs itself for autorun at Windows startup
  • Clears Windows events or logs
  • Creates a copy of itself
  • Uses suspicious command line tools or Windows utilities

Related domains:

api.my-ip.io
apps.identrust.com
crl.identrust.com
x1.c.lencr.org
r3.o.lencr.org

How to determine Ransom:Win32/Taleb.PAA!MTB?


File Info:

crc32: 2E97551F
md5: 784fe6761824ce0d7dd9252200b2ca55
name: 784FE6761824CE0D7DD9252200B2CA55.mlw
sha1: 4d0957d87e700367d62f974af56b358bafe588b8
sha256: e615aae714898a4f78dc35243b76440021527835c02cdb904349e412b9631b8c
sha512: 3019a43d6aff581ff8e2d11d4debe3c6edd807355e70224e4290a8075df9798ec696c41dac17a6ff7487b527d93e203463fd57200d264211b20f2bad5bafdb4a
ssdeep: 24576:ehPO3HkozHUaovTh7/hcEm5vc/TK0xNd58u5m5I7Tbie7e9xHcXL+klUQJ9qW:b3H1HDURiAmyDhXL+gUQPx
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Ransom:Win32/Taleb.PAA!MTB also known as:

Elasticmalicious (high confidence)
DrWebTrojan.Encoder.34335
CynetMalicious (score: 100)
ALYacDeepScan:Generic.Ransom.AmnesiaE.032A926B
ZillyaTrojan.Filecoder.Win32.20053
Cybereasonmalicious.61824c
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Filecoder.Ouroboros.G
AvastWin32:Trojan-gen
ClamAVWin.Ransomware.Vipasana-9783618-1
KasperskyHEUR:Trojan.Win32.Stosek.gen
BitDefenderDeepScan:Generic.Ransom.AmnesiaE.032A926B
MicroWorld-eScanDeepScan:Generic.Ransom.AmnesiaE.032A926B
TencentMalware.Win32.Gencirc.11cd6646
Ad-AwareDeepScan:Generic.Ransom.AmnesiaE.032A926B
SophosGeneric ML PUA (PUA)
BitDefenderThetaGen:NN.ZexaF.34170.qvW@aqKrDtgi
FireEyeDeepScan:Generic.Ransom.AmnesiaE.032A926B
EmsisoftDeepScan:Generic.Ransom.AmnesiaE.032A926B (B)
SentinelOneStatic AI – Suspicious PE
JiangminTrojan.Stosek.m
eGambitUnsafe.AI_Score_94%
Antiy-AVLTrojan/Generic.ASCommon.1B2
MicrosoftRansom:Win32/Taleb.PAA!MTB
GDataDeepScan:Generic.Ransom.AmnesiaE.032A926B
AhnLab-V3Ransomware/Win.VOIDCRYPT.C4454770
McAfeeGenericRXPJ-KC!784FE6761824
MAXmalware (ai score=84)
VBA32Trojan.Stosek
MalwarebytesRansom.FileCryptor
PandaTrj/Genetic.gen
YandexTrojan.Stosek!XN6igwV+WL4
FortinetW32/Ouroboros.G!tr.ransom
AVGWin32:Trojan-gen

How to remove Ransom:Win32/Taleb.PAA!MTB?

Ransom:Win32/Taleb.PAA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment