Ransom

About “Ransom:Win64/AzovCrypt.PA!MTB” infection

Malware Removal

The Ransom:Win64/AzovCrypt.PA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ransom:Win64/AzovCrypt.PA!MTB virus can do?

  • Sample contains Overlay data
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Ransom:Win64/AzovCrypt.PA!MTB?



File Info:

name: 25E6597CAFBA05BF7DAC.mlw
path: /opt/CAPEv2/storage/binaries/5abd59189a799c957828d856da453441109817869ecaaa9ab4cd4721ddd2eede
crc32: 49809A01
md5: 25e6597cafba05bf7dacece24570193d
sha1: 52e1cdadbce2ee78453d8246e33e4d40c35d5764
sha256: 5abd59189a799c957828d856da453441109817869ecaaa9ab4cd4721ddd2eede
sha512: d4f53288a1d9c5211d900089217b1781c17569913c1fd58a6c71a630ec28e3462ece277917bce21c402e88ab49f833162222cee30637942ac735c8bfe919f331
ssdeep: 12288:jiS9QaUf1Qs9AMu9kPtJGVh/tSQQcJfcuCYdQeUvyZ9QMNEjSIw3:jiK8f1sNqPtJsZtZQscuCxr6HQMCjSN
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T161057C51B3F481F9F1B7AA7199B6A637EA7179515C38C74E4240C68E1F33A40892BB33
sha3_384: 8d694c75fc38d2b823b7dae989f715a10b78fcf3db9eeac3931e60e8f9559fb59ebf98ae32443bee0bd008f8bbfde095
ep_bytes: e848feffffc82000004c897c24f84883
timestamp: 2009-07-13 23:57:52


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Executable for Hearts Game
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
InternalName: hearts.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: hearts.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7600.16385
OleSelfRegister: 
Translation: 0x0409 0x04b0

Ransom:Win64/AzovCrypt.PA!MTB also known as:

MicroWorld-eScanGen:Variant.Ulise.386969
FireEyeGen:Variant.Ulise.386969
ALYacGen:Variant.Ulise.386969
CylanceUnsafe
CrowdStrikewin/malicious_confidence_90% (D)
BitDefenderGen:Variant.Ulise.386969
K7GWTrojan ( 0059aa0b1 )
K7AntiVirusTrojan ( 0059aa0b1 )
ArcabitTrojan.Ulise.D5E799
CyrenW64/Ipamor.A
SymantecML.Attribute.HighConfidence
ESET-NOD32Win64/Filecoder.GG
APEXMalicious
KasperskyUDS:Trojan-Ransom.Win32.Blocker
RisingRansom.Agent!8.6B7 (TFE:2:U9tOTBNOHOO)
Ad-AwareGen:Variant.Ulise.386969
SophosMal/Generic-S + Troj/Azov-A
DrWebWin32.HLLP.Azov.2
VIPREGen:Variant.Ulise.386969
TrendMicroRansom.Win64.AZVO.SMYXCJ5
McAfee-GW-EditionBehavesLike.Win64.Generic.bh
EmsisoftGen:Variant.Ulise.386969 (B)
IkarusTrojan-Ransom.FileCrypter
JiangminTrojan.Blocker.urx
Antiy-AVLGrayWare/Win32.Filecoder.gg
MicrosoftRansom:Win64/AzovCrypt.PA!MTB
GDataGen:Variant.Ulise.386969
GoogleDetected
AhnLab-V3Trojan/Win.Generic.R533482
McAfeeArtemis!25E6597CAFBA
MAXmalware (ai score=83)
MalwarebytesRansom.Azov
PandaTrj/CI.A
MaxSecureTrojan.Malware.121218.susgen
FortinetW64/Filecoder.GG!tr
AVGWin64:Trojan-gen
AvastWin64:Trojan-gen

How to remove Ransom:Win64/AzovCrypt.PA!MTB?

Ransom:Win64/AzovCrypt.PA!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment