Categories: Malware

Crypt.44 information

The Crypt.44 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Crypt.44 virus can do?

Executable code extraction
Creates RWX memory
Mimics the system’s user agent string for its own requests
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Queries information on disks, possibly for anti-virtualization
Checks for the presence of known windows from debuggers and forensic tools
Behavior consistent with a dropper attempting to download the next stage.
Exhibits behavior characteristic of Locky ransomware

How to determine Crypt.44?


File Info:
crc32: 3EE25C02md5: baa6f26db31199ee037ef70e272faf23name: BAA6F26DB31199EE037EF70E272FAF23.mlwsha1: c3080c133698f08e3afd3ceffdc4225855a95171sha256: 4e9df17a38c9d85be1b5e13c5c777d2575b71f8397b753fffc8ab81eda6d919csha512: f4a3fe84d5e21e01642bfb60899551a920d86fad5f14f1864a212df3937b196259051cb3b821a9450c71af1bbde807f8e8a8284d8ce5d97d9638e792adefc533ssdeep: 6144:kLZglDuSfqBB2Zh6akQr+H7nuejQSrg4+I6J6IwvJesD7uSDAvQ:IglvqBB2Zh6auH7uYfrg4d6J6IMJeWtFtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright xa9HAMSTERsoft . 1999 - 2014CompanyName: HAMSTERsoft ProductName: MediatedProductVersion: 4.7.1.9FileDescription: Permanente Interleave Grats Dichotomy LastedOriginalFilename: MediatedTranslation: 0x0409 0x04b0

Crypt.44 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.baa6f26db31199ee
McAfee	Artemis!BAA6F26DB311
Cylance	Unsafe
Zillya	Trojan.GenKryptik.Win32.52950
AegisLab	Trojan.Win32.Generic.4!c
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0056e9231 )
BitDefender	Gen:Variant.Crypt.44
K7GW	Trojan ( 0056e9231 )
CrowdStrike	win/malicious_confidence_100% (D)
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.Cryptor.bnz
Alibaba	Ransom:Win32/Cryptor.22ba549b
NANO-Antivirus	Trojan.Win32.Encoder.evqwtb
MicroWorld-eScan	Gen:Variant.Crypt.44
Ad-Aware	Gen:Variant.Crypt.44
Emsisoft	Gen:Variant.Crypt.44 (B)
Comodo	Malware@#1a1b61ktp6rq5
F-Secure	Heuristic.HEUR/AGEN.1101369
DrWeb	Trojan.Encoder.3976
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_HPLOCKY.SME
McAfee-GW-Edition	BehavesLike.Win32.Downloader.fc
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1101369
MAX	malware (ai score=99)
Antiy-AVL	Trojan[Ransom]/Win32.Cryptor
Microsoft	Ransom:Win32/Locky
Arcabit	Trojan.Crypt.44
ZoneAlarm	Trojan-Ransom.Win32.Cryptor.bnz
GData	Gen:Variant.Crypt.44
Acronis	suspicious
VBA32	TrojanRansom.Cryptor
ALYac	Gen:Variant.Crypt.44
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/Kryptik.ERCC
TrendMicro-HouseCall	Ransom_HPLOCKY.SME
Rising	Trojan.Generic@ML.83 (RDMK:eLSBsXZ4u1fmPJX/dczUrg)
Yandex	Trojan.GenKryptik!8VYLJnPW4yg
Ikarus	Trojan-Ransom.Cryptor
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Cryptor.BNZ!tr
BitDefenderTheta	Gen:NN.ZexaF.34590.wq0@aeycqTbi
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Ransom.Cryptor.HgIASOUA