About “Ransom:Win32/WannaCrypt.DA!MTB” infection

The Ransom:Win32/WannaCrypt.DA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:Win32/WannaCrypt.DA!MTB virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Ransom:Win32/WannaCrypt.DA!MTB?


File Info:
name: 4885C845EC854BE88E1C.mlw
path: /opt/CAPEv2/storage/binaries/014970e3cac6dc1d6d85cea6734aa4155a15e0ca6c961aa5930ba1cdb4d6ff0f
crc32: 2B1661D6
md5: 4885c845ec854be88e1ce577d37e1c33
sha1: 5cc405a2a4facd79628736e3a097778fef680f1a
sha256: 014970e3cac6dc1d6d85cea6734aa4155a15e0ca6c961aa5930ba1cdb4d6ff0f
sha512: bfab583b5046a9d272413008d656ca72d072774215031b40d69e03ab5c72a87fa6f95974ee8f80a1abb29e1a1e4ae9a526241f53fb74904bbed51e699b0ee5a2
ssdeep: 49152:LMSPbcBVs/1INRx+TSqTdX1HkQo6SAARdhnvm:LPoBK1aRxcSUDk36SAEdhvm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1869533F5B0B256B8E3062D7444AFDA5376D5707A35EB3D11EF8008B9B896E5BD3802C2
sha3_384: 7ff6e74692e6e08b9e4988401eb44f10b9ac50ca9c2d734aa0f95acadddbf2799d94dad1bb3d79d4bca104e4fa13d8e2
ep_bytes: b139cba1d062aa4f875e1693b609ef62
timestamp: 2015-09-20 19:44:01

Version Info:
0: [No Data]

Ransom:Win32/WannaCrypt.DA!MTB also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Wanna.tpUE
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Generic.22783564
FireEye	Generic.mg.4885c845ec854be8
CAT-QuickHeal	Trojan.GenericPMF.S16335961
ALYac	Trojan.Generic.22783564
Cylance	Unsafe
K7AntiVirus	Ransomware ( 00542db01 )
Alibaba	Ransom:Win32/Agentb.dbe
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.5ec854
VirIT	Trojan.Win32.Encoder.QXS
Cyren	W32/Trojan.UUBY-7729
Symantec	SMG.Heur!gen
ESET-NOD32	Win32/Filecoder.WannaCryptor.N
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Ransomware.Wannacry-6803937-0
Kaspersky	Trojan-Ransom.Win32.Wanna.apno
BitDefender	Trojan.Generic.22783564
NANO-Antivirus	Trojan.Win32.Wanna.forlua
SUPERAntiSpyware	Ransom.Crypt/Variant
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.10ba4438
Ad-Aware	Trojan.Generic.22783564
Emsisoft	Trojan.Generic.22783564 (B)
Comodo	TrojWare.Win32.Ransom.WannaCry.SU@83tnqe
DrWeb	Trojan.Encoder.11432
Zillya	Trojan.Rasftuby.Win32.241
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=81)
Microsoft	Ransom:Win32/WannaCrypt.DA!MTB
GData	Trojan.Generic.22783564
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.WannaCryptor.R229339
McAfee	GenericRXDX-QB!4885C845EC85
TACHYON	Ransom/W32.Agent.2061938
VBA32	TrojanRansom.Wanna
Malwarebytes	WannaCry.Ransom.Encrypt.DDS
Rising	Trojan.Win32.Rasftuby.a (CLASSIC)
Yandex	Trojan.Agent!18Ax3m9d6Qc
Ikarus	Trojan-Ransom.WannaCrypt
Fortinet	W32/GenericRXDR.TD!tr
AVG	Win32:Malware-gen

How to remove Ransom:Win32/WannaCrypt.DA!MTB?

Ransom:Win32/WannaCrypt.DA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X