What is “Trojan-Ransom.Win32.Blocker.sows”?

The Trojan-Ransom.Win32.Blocker.sows is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Ransom.Win32.Blocker.sows virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Network activity detected but not expressed in API logs
• Harvests cookies for information gathering
• Anomalous binary characteristics

Related domains:

How to determine Trojan-Ransom.Win32.Blocker.sows?

File Info:
name: C9027870C8DBDE8F9E2E.mlw
path: /opt/CAPEv2/storage/binaries/911836647fb3e7cc4d9366f037950763734a1d861dca2d42ecd9956f9a8d882c
crc32: 19FFB454
md5: c9027870c8dbde8f9e2e8eded79b60be
sha1: 6102d0eca1d336bcb0a9fb1f722e4c4122f54766
sha256: 911836647fb3e7cc4d9366f037950763734a1d861dca2d42ecd9956f9a8d882c
sha512: 40427c11c5e0e088377e99644b477105348f7699a34f223d228845f138e88ec095719118b25cda9509856afd5018c99b363c5eb29a14d27a53930732694ca2d1
ssdeep: 196608:0iazg7DS8iazg7DS8iazg7DS8iazg7DSv:8g7ukg7ukg7ukg7uv
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13D86137AF1908437D1236E7CCC5BA754A825BEE02D28608A7BEC1C4DDF39B8135262D7
sha3_384: b2a71d19d68d4d871b086fac1fa96f3cef96f8270a30d476c1d210cbb0bc29e65af934b013290242e7490b3084db762b
ep_bytes: 55545d906a2890596a006a004975f953
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Trojan-Ransom.Win32.Blocker.sows also known as:

How to remove Trojan-Ransom.Win32.Blocker.sows?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.