Trojan-Ransom.Win32.Gen.aatp (file analysis)

Malware Removal

The Trojan-Ransom.Win32.Gen.aatp is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan-Ransom.Win32.Gen.aatp virus can do?

  • Executable code extraction
  • At least one process apparently crashed during execution
  • Possible date expiration check, exits too soon after checking local time
  • The binary likely contains encrypted or compressed data.
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Spoofs its process name and/or associated pathname to appear as a legitimate process
  • Checks the system manufacturer, likely for anti-virtualization
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

Related domains:

baroquetees.com

How to determine Trojan-Ransom.Win32.Gen.aatp?


File Info:

crc32: 8CA2685D
md5: a7cefa7c6ae37bbca616cc76f4a98603
name: A7CEFA7C6AE37BBCA616CC76F4A98603.mlw
sha1: 9993b385d5ab214403957cea0f314927bc3719e2
sha256: e51e4c372edf2bbe476a4b7630225c1875c5ccea2ed55b418bd793c54ce9a84d
sha512: cec4fd044214bae59bef8c6b95b3be8d5c812f3f415580485c85ab0d9f5976a634b1e29cef910118a122f2c740ed77aeab2f378a0dd652664644999fd286cec9
ssdeep: 1536:1zPnNKCpixACo4/NTz+mra8Yman5OfElN3ppESsqKqe:17n4Cpixk4/NTla8YmA5np7Kqe
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Trojan-Ransom.Win32.Gen.aatp also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 005795061 )
Elasticmalicious (high confidence)
DrWebTrojan.Encoder.33742
CynetMalicious (score: 100)
ALYacGen:Trojan.Heur.FU.duW@aSFpKnm
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaRansom:Win32/DarkSide.b08f62a3
K7GWTrojan ( 005795061 )
Cybereasonmalicious.c6ae37
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Filecoder.DarkSide.B
APEXMalicious
AvastWin32:Trojan-gen
KasperskyTrojan-Ransom.Win32.Gen.aatp
BitDefenderGen:Trojan.Heur.FU.duW@aSFpKnm
NANO-AntivirusVirus.Win32.Gen-Crypt.ccnc
MicroWorld-eScanGen:Trojan.Heur.FU.duW@aSFpKnm
TencentWin32.Trojan.Crypt.Loru
Ad-AwareGen:Trojan.Heur.FU.duW@aSFpKnm
SophosMal/Generic-S
BitDefenderThetaAI:Packer.0E94F0331E
McAfee-GW-EditionBehavesLike.Win32.Generic.qc
FireEyeGeneric.mg.a7cefa7c6ae37bbc
EmsisoftGen:Trojan.Heur.FU.duW@aSFpKnm (B)
SentinelOneStatic AI – Malicious PE
WebrootW32.Ransom.Gen
AviraTR/Crypt.XPACK.Gen
eGambitUnsafe.AI_Score_93%
MicrosoftRansom:Win32/DarkSide.DA!MTB
ArcabitTrojan.Heur.FU.ED15C87
AegisLabTrojan.Win32.Encoder.j!c
ZoneAlarmTrojan-Ransom.Win32.Gen.aatp
GDataGen:Trojan.Heur.FU.duW@aSFpKnm
McAfeeArtemis!A7CEFA7C6AE3
MAXmalware (ai score=80)
MalwarebytesMalware.Heuristic.1003
PandaTrj/CI.A
TrendMicro-HouseCallRansom_DarkSide.R002C0DCV21
RisingRansom.Encoder!8.FFD4 (CLOUD)
IkarusTrojan-Ransom.DarkSide
FortinetW32/DarkSide.B!tr.ransom
AVGWin32:Trojan-gen
Qihoo-360Win32/Ransom.Generic.HxMBR0cA

How to remove Trojan-Ransom.Win32.Gen.aatp?

Trojan-Ransom.Win32.Gen.aatp removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment