Trojan-Ransom.Phobos (A) (file analysis)

The Trojan-Ransom.Phobos (A) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Ransom.Phobos (A) virus can do?

• Executable code extraction
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• Reads data out of its own binary image
• A process created a hidden window
• The binary likely contains encrypted or compressed data.
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Likely virus infection of existing system binary
• Anomalous binary characteristics

How to determine Trojan-Ransom.Phobos (A)?

File Info:
crc32: DCA218A5
md5: 1ee37f16676ca70db5ef05550c74a51d
name: rvdhtffsd.exe
sha1: fb8778db0ad995d281e617bfae5c2a004af0d3ff
sha256: 0369b316850229bb110d6319300e81cb5529f0d1e00d07d0245bf02dd78965f6
sha512: e752ceb11b5d3884a28ebdca9735bc5be30a770317ddc0e37d5dc49c2399ab97404a9be7100a719734d97ceaa9e2bcb94573f82652a3f915e4f947e2898ac07c
ssdeep: 1536:AFCdAhJLGy9ADTvYdKTFMywkYRVdV9MbG5qnqMHbpZQteKPOb5mc2Q5ED:AFdP3ewoJKV39pqqcQt9o5KD
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) half-timer 2019
InternalName: gaincome.exe
FileVersion: 1.3.0.5
CompanyName: Reamstown
ProductName: gaincome
ProductVersion: 7.4.5.2
FileDescription: arrowroot
OriginalFilename: fader.exe
Translation: 0x0409 0x04b0

Trojan-Ransom.Phobos (A) also known as:

How to remove Trojan-Ransom.Phobos (A)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.