About "Trojan.Ransom.Babuk.A (B)" infection

The Trojan.Ransom.Babuk.A (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Ransom.Babuk.A (B) virus can do?

A process created a hidden window
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Uses Windows utilities for basic functionality
Attempts to delete volume shadow copies
Attempts to repeatedly call a single API many times in order to delay analysis time
Exhibits possible ransomware file modification behavior
Network activity detected but not expressed in API logs
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan.Ransom.Babuk.A (B)?


File Info:
crc32: BDCA339F
md5: 544781e9390b16dbd1a018e5bed49147
name: 544781E9390B16DBD1A018E5BED49147.mlw
sha1: 416fee1be3c55dc03aa1563dee77afbabbf416aa
sha256: b6a74c64437b815016248edc661c7bcf21b190738d936f4c6ce57333ff0e6fad
sha512: 892350e39e8a736e9b17063a6985ce51fd020237d47b2861d70c36edb15e4bea38c036856afbb6ee568472c26c362ccae868ae018c4fe8c37d479eaba66540e4
ssdeep: 768:PgxMVrf3vt/7UIzARsbwA5ep27hkKEVQXF:PgqDRgIWsscepF
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
0: [No Data]

Trojan.Ransom.Babuk.A (B) also known as:

Bkav	W32.AIDetect.malware1
Cynet	Malicious (score: 100)
ALYac	Trojan.Ransom.Babuk.A
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_60% (D)
Cybereason	malicious.9390b1
Symantec	Ransom.Babuk
ESET-NOD32	a variant of Win32/Filecoder.Babyk.A
APEX	Malicious
Avast	Win32:Dh-A [Heur]
ClamAV	Win.Ransomware.Maze-7473772-0
Kaspersky	HEUR:Trojan-Ransom.Win32.Generic
BitDefender	Trojan.Ransom.Babuk.A
NANO-Antivirus	Trojan.Win32.Ransom.iuaipi
ViRobot	Trojan.Win32.Ransom.80896.E[UPX]
MicroWorld-eScan	Trojan.Ransom.Babuk.A
Ad-Aware	Trojan.Ransom.Babuk.A
Sophos	ML/PE-A + Troj/Ransom-GGD
BitDefenderTheta	Gen:NN.ZexaF.34796.bmGfaGfzPTe
McAfee-GW-Edition	BehavesLike.Win32.Generic.mc
FireEye	Generic.mg.544781e9390b16db
Emsisoft	Trojan.Ransom.Babuk.A (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Crypt.XPACK.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan-Ransom.Win32.Generic
GData	Trojan.Ransom.Babuk.A
TACHYON	Ransom/W32.BabukLocker.80896.B
McAfee	GenericRXPB-MY!9175AFC06F00
MAX	malware (ai score=80)
VBA32	BScope.TrojanRansom.Gen
Panda	Trj/GdSda.A
Rising	Ransom.Babuk!1.D7A0 (CLASSIC)
Ikarus	Trojan-Ransom.Babyk
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/FilecoderProt.F183!tr.ransom
AVG	Win32:Dh-A [Heur]
Qihoo-360	HEUR/QVM11.1.A6C7.Malware.Gen

How to remove Trojan.Ransom.Babuk.A (B)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Trojan.Ransom.Babuk.A (B)” infection