Ransom Trojan

Should I remove “Trojan-Ransom.Win32.Blocker.ulhc”?

Malware Removal

The Trojan-Ransom.Win32.Blocker.ulhc is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan-Ransom.Win32.Blocker.ulhc virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • A process created a hidden window
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Uses Windows utilities for basic functionality
  • Behavioural detection: Injection (Process Hollowing)
  • Executed a process and injected code into it, probably while unpacking
  • Sniffs keystrokes
  • Behavioural detection: Injection (inter-process)
  • Created a process from a suspicious location
  • Installs itself for autorun at Windows startup
  • Harvests cookies for information gathering
  • Anomalous binary characteristics

How to determine Trojan-Ransom.Win32.Blocker.ulhc?


File Info:

name: 37309ED295BA60D45ADA.mlw
path: /opt/CAPEv2/storage/binaries/03496d40654c99a467faec878f2ae9a8186de3a17f1ffc384c1cad5289014bc8
crc32: 6D50E1DF
md5: 37309ed295ba60d45ada1dff913144a2
sha1: ba1d95e645418318e910ad31149a8b0969628278
sha256: 03496d40654c99a467faec878f2ae9a8186de3a17f1ffc384c1cad5289014bc8
sha512: b6fda2d644115a8f831c05287af061fe33cdf6cf6c7da0e132ae5fca62016d97951dbec59aa2fff0c774e5a1e1c96a921e49f213e7cdc259ede691fb7ca46324
ssdeep: 196608:00azg7DS80azg7DS8h0azg7DS80azg7DC:Sg7uKg7uMg7uKg7e
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16586123AF5D08437D1236E7CCC5BA794A825BEE01D28608A7BEC1D49DF39B8135262D7
sha3_384: f931544de7e905c3e7a511771d1fdfd585aaffd62c9057985e478d1ab66f4b96dcf4338afeec1888a2895ed8c2997afb
ep_bytes: 55545d906a2890596a006a004975f953
timestamp: 1992-06-19 22:22:17

Version Info:

0: [No Data]

Trojan-Ransom.Win32.Blocker.ulhc also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Androm.m!c
Elasticmalicious (high confidence)
DrWebTrojan.DownLoader6.7779
MicroWorld-eScanGen:Variant.Symmi.34741
FireEyeGeneric.mg.37309ed295ba60d4
CAT-QuickHealTrojan.WacatacPMF.S16539689
McAfeeGenericRXIP-BJ!37309ED295BA
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 00548e051 )
AlibabaTrojan:Win32/Starter.ali1001008
K7GWTrojan ( 00548e051 )
Cybereasonmalicious.295ba6
BitDefenderThetaAI:Packer.9896AD8521
CyrenW32/Injector.OZVT-2500
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Injector.AHHO
TrendMicro-HouseCallTROJ_GEN.R002C0DL821
Paloaltogeneric.ml
ClamAVWin.Trojan.Mbrlock-9779766-0
KasperskyTrojan-Ransom.Win32.Blocker.ulhc
BitDefenderGen:Variant.Symmi.34741
NANO-AntivirusTrojan.Win32.Dapato.bsjzfg
AvastWin32:MBRlock-DV [Trj]
TencentTrojan.Win32.Blocker.zg
Ad-AwareGen:Variant.Symmi.34741
TACHYONBackdoor/W32.Androm.7880704
SophosMal/Generic-R + Troj/Agent-BFYB
ComodoTrojWare.Win32.Injector.HO@82j6jo
TrendMicroTROJ_GEN.R002C0DL821
McAfee-GW-EditionBehavesLike.Win32.Generic.wc
EmsisoftGen:Variant.Symmi.34741 (B)
IkarusTrojan-Downloader.Win32.Banload
GDataWin32.Trojan.PSE.13Q4XMA
JiangminTrojan.Gimemo.afj
AviraTR/Crypt.XPACK.Gen
Antiy-AVLTrojan[Ransom]/Win32.Blocker
MicrosoftTrojan:Win32/Injector.INK!MTB
CynetMalicious (score: 100)
AhnLab-V3Dropper/Win32.Dapato.R83155
Acronissuspicious
VBA32Trojan.Downloader
MAXmalware (ai score=82)
MalwarebytesTrojan.Crypt
APEXMalicious
RisingTrojan.Injector!1.DA56 (CLASSIC)
YandexTrojan.Injector!nfedw5apY3U
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_95%
FortinetW32/Injector.AHHO!tr
AVGWin32:MBRlock-DV [Trj]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Trojan-Ransom.Win32.Blocker.ulhc?

Trojan-Ransom.Win32.Blocker.ulhc removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment