Categories: RansomTrojan

What is “UDS:Trojan-Ransom.Win32.Petr.sb”?

The UDS:Trojan-Ransom.Win32.Petr.sb is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What UDS:Trojan-Ransom.Win32.Petr.sb virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Likely installs a bootkit via raw harddisk modifications
Attempts to restart the guest VM
Network activity detected but not expressed in API logs
Attempts to identify installed AV products by installation directory
Mimics icon used for popular non-executable file format
Anomalous binary characteristics

How to determine UDS:Trojan-Ransom.Win32.Petr.sb?


File Info:
crc32: BB5E26B9md5: e172f063026ba4cbb3e10ef3d0e23a7fname: E172F063026BA4CBB3E10EF3D0E23A7F.mlwsha1: 2e90c54f4b058b090542f3f30385e01078229fc0sha256: a8ee738bbd43982801b3b7b7cebc589f04257f6cb8d90120cc5d2fced2cc954esha512: 70eb97a2675ab8b9897631e1ab126d38d287beb50b565aeaa30b6f87e8a8dbbbc00c40dc81793abbd7b9043d7ae0d482723252aac9176ddb4e68a6acb3f7ee6essdeep: 24576:lImR3Ds/JaW1YTirTy9KJ+UsrTo3XuSKqLRuV2:qmdsRzdZIUgoO0Rugtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2003-2013InternalName: AutoHotkeyFileVersion: 1.1.23.05ProductName: AutoHotkeyProductVersion: 1.1.23.05FileDescription: AutoHotkey Unicode 32-bitOriginalFilename: AutoHotkey.exeTranslation: 0x0409 0x04b0

UDS:Trojan-Ransom.Win32.Petr.sb also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 004efa661 )
DrWeb	Trojan.Encoder.4544
Cynet	Malicious (score: 99)
CAT-QuickHeal	Ransom.Petya.MUE.S4
Cylance	Unsafe
K7GW	Trojan ( 004efa661 )
Cybereason	malicious.f4b058
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Diskcoder.Petya.C
APEX	Malicious
Avast	FileRepMalware
ClamAV	Win.Dropper.Petya-3
Kaspersky	UDS:Trojan-Ransom.Win32.Petr.sb
NANO-Antivirus	Trojan.Win32.Encoder.ezbvlp
Tencent	Malware.Win32.Gencirc.11491b45
Sophos	Mal/Generic-S
Comodo	Malware@#17399se49riz2
F-Secure	Trojan.TR/Ransom.jktso
BitDefenderTheta	Gen:NN.ZexaF.34738.7q0@aOx2H6ji
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dh
FireEye	Generic.mg.e172f063026ba4cb
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.Generic.btmcd
Avira	TR/Ransom.jktso
Antiy-AVL	Trojan/Generic.ASMalwS.25136F5
Microsoft	Ransom:Win32/Mischa.A
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	HEUR:Trojan.Win32.Generic
McAfee	Ransomware-FKM!E172F063026B
MAX	malware (ai score=100)
Panda	Trj/CI.A
Yandex	Trojan.Agent!3nU4OkH0TMM
Ikarus	Trojan.Win32.Diskcoder
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Petya.HS!tr.ransom
AVG	FileRepMalware
Paloalto	generic.ml