Trojan-Ransom.Win32.Petr.t (file analysis)

The Trojan-Ransom.Win32.Petr.t is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Ransom.Win32.Petr.t virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Likely installs a bootkit via raw harddisk modifications
Attempts to restart the guest VM
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan-Ransom.Win32.Petr.t?


File Info:
crc32: 919E5B02
md5: d85ffc852937a314ae32b5e0634f4bda
name: D85FFC852937A314AE32B5E0634F4BDA.mlw
sha1: 5ff8ec28fcfd3acf9e96499fd875b05a6caba2f5
sha256: a6311032d1b305b74ae3c8bd0bde2866633407693cad62cd7e3abb9444574d7d
sha512: a920dcbc246c176587c027e7651e509f94ffa90c08bb49fe2035d17a2668d7524b15176bd3d84ad98b827799170e0bcd0dfb078662bbedc3645ba7d2922ce42a
ssdeep: 12288:j5UnhjOmG0fJO6egoEQFauJsfmhR5ju0phsQkPaUynemuSljjQt6pgw/HuAHL7f:FUnxUjJVhRZdpmQkYelOjjQtSg672
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Trojan-Ransom.Win32.Petr.t also known as:

CAT-QuickHeal	Ransom.Petya.MUE.S6
ALYac	Trojan.GenericKD.3136553
Sangfor	Suspicious.Win32.Save.a
Alibaba	Ransom:Win32/Petya.d35d310b
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Cyren	W32/Diskcoder.TLBG-3980
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/Diskcoder.Petya.A
Zoner	Trojan.Win32.40916
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 99)
Kaspersky	Trojan-Ransom.Win32.Petr.t
BitDefender	Trojan.GenericKD.3136553
NANO-Antivirus	Trojan.Win32.Petya.ebxyaa
MicroWorld-eScan	Trojan.GenericKD.3136553
Tencent	Win32.Trojan.Petr.Wrgp
Ad-Aware	Trojan.GenericKD.3136553
Sophos	Mal/Generic-L
Comodo	Malware@#1fvoo5k2l3sa
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_PETYA.G
McAfee-GW-Edition	BehavesLike.Win32.Dropper.bh
FireEye	Trojan.GenericKD.3136553
Emsisoft	Trojan.GenericKD.3136553 (B)
Webroot	Ransomware.Petya.Gen
Avira	TR/Petya.khvh
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Ransom:Win32/Petya
SUPERAntiSpyware	Ransom.Petya/Variant
ZoneAlarm	Trojan-Ransom.Win32.Petr.t
GData	Win32.Trojan.Agent.C471K2
AhnLab-V3	Trojan/Win32.Ransom.R178308
McAfee	Generic.ys
MAX	malware (ai score=84)
VBA32	Hoax.Petr
Panda	Trj/WLT.B
TrendMicro-HouseCall	Ransom_PETYA.G
Rising	Trojan.Generic@ML.86 (RDML:RnhG1jHGFUhpZqKb/+n5Rw)
Yandex	Trojan.Petr!37FgQK6i9Jk
Ikarus	Trojan.Win32.Diskcoder
Fortinet	W32/Generic.AC.342262!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Trojan-Ransom.Win32.Petr.t?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan-Ransom.Win32.Petr.t (file analysis)