About "Trojan.Ransom.CryptXXXKD.12606636" infection

The Trojan.Ransom.CryptXXXKD.12606636 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Ransom.CryptXXXKD.12606636 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan.Ransom.CryptXXXKD.12606636?


File Info:
crc32: 800DB14C
md5: aec6303c0a50a44c61581c53c0bd92d9
name: AEC6303C0A50A44C61581C53C0BD92D9.mlw
sha1: f7e85f4dced14cdb6155fec86e846ad3e903b2b6
sha256: 003e685ce9517f309b9c2469b7e6e0cd1c8bdfdf36b328ed0c4d52289769f9fd
sha512: bb71c9ddd4914bda6d689f595983c497df350b13567415dc7418ec8e23eb2d44c07fb361e6221b322c3fb4d4f77b53176acc0fec672a7e03cd9a112b49b2940e
ssdeep: 6144:YRwRsi2gBJDx+QQKl7enV5SOZdzNqYTtcny6y:5920V+jKl16Ttay
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2013 Nero AG and its licensors
InternalName: NeroDisc
FileVersion: 15,0,25,0
CompanyName: Nero AG
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: NeroDiscMergeWrongDisc
SpecialBuild: 15,0,25,0
ProductVersion: 15,0,25,0
FileDescription: NeroDiscMergeWrongDisc Application
OriginalFilename: NeroDiscMergeWrongDisc.exe
Translation: 0x0409 0x04e4

Trojan.Ransom.CryptXXXKD.12606636 also known as:

K7AntiVirus	Trojan ( 0051e08e1 )
Lionic	Trojan.Win32.Generic.4!c
Cynet	Malicious (score: 99)
CAT-QuickHeal	Downldr.Freepds.MUE.ZZ5
ALYac	Trojan.Ransom.CryptXXXKD.12606636
Cylance	Unsafe
Zillya	Trojan.CryptXXX.Win32.770
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/Tovicrypt.c9b1a462
K7GW	Trojan ( 0051e08e1 )
Cybereason	malicious.c0a50a
Cyren	W32/S-2af32512!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.BHOV
Zoner	Probably Heur.ExeHeaderH
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Ransom.CryptXXXKD.12606636
NANO-Antivirus	Trojan.Win32.CryptXXX.evdmut
MicroWorld-eScan	Trojan.Ransom.CryptXXXKD.12606636
Tencent	Win32.Trojan.Cryptxxx.Lrik
Ad-Aware	Trojan.Ransom.CryptXXXKD.12606636
Sophos	Mal/Generic-R + Mal/Swizzor-D
Comodo	Malware@#27pxtc2zk2fob
BitDefenderTheta	Gen:NN.ZexaF.34142.xy0@aCnTzxti
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Mal_Crypmic-1
McAfee-GW-Edition	Ransomware-GJA!AEC6303C0A50
FireEye	Generic.mg.aec6303c0a50a44c
Emsisoft	Trojan.Ransom.CryptXXXKD.12606636 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1110705
Antiy-AVL	Trojan/Generic.ASMalwS.22B71B0
Microsoft	Ransom:Win32/Tovicrypt.A
Arcabit	Trojan.Ransom.CryptXXXKD.DC05CAC
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.Ransom.CryptXXXKD.12606636
Acronis	suspicious
McAfee	Ransomware-GJA!AEC6303C0A50
VBA32	TScope.Malware-Cryptor.SB
Malwarebytes	Malware.AI.2451378745
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Mal_Crypmic-1
Rising	Trojan.Generic@ML.95 (RDML:0iI5byIEQirWze4043ZCqw)
Yandex	Trojan.GenAsa!/Jktgqz9N7U
Ikarus	Trojan-Ransom.Tovicrypt
MaxSecure	Win.MxResIcn.Heur.Gen
Fortinet	W32/Kryptik.FNZR!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Trojan.Ransom.CryptXXXKD.12606636?

Trojan.Ransom.CryptXXXKD.12606636 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Trojan.Ransom.CryptXXXKD.12606636” infection