Malware

Kazy.11649 removal guide

Malware Removal

The Kazy.11649 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Kazy.11649 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • Authenticode signature is invalid

How to determine Kazy.11649?



File Info:

name: 4D24A003AEB6F6E2F4A0.mlw
path: /opt/CAPEv2/storage/binaries/c9685ac2d12663cda185ef2a54138be668671cbdfedb19f423daeedb6cc81621
crc32: A455D756
md5: 4d24a003aeb6f6e2f4a061703a187c9b
sha1: f970e0db7c7f8fee62ff488468b88fbaefcee77a
sha256: c9685ac2d12663cda185ef2a54138be668671cbdfedb19f423daeedb6cc81621
sha512: 14f114a01a0d71f22308e0982ba8db0e7b5c00f96e2d3530ac41ff410ac31196901ff664604f852540396227373ab434d7a67bbfe460b83b5591c386cb205da9
ssdeep: 3072:t3nbWfLKMKi3ufuFZeXyy3Cq1U7JqvNRYVv9scAheOXwP8+yE725UI:ienfuFZvOZm7Jql6VvtAYO+05
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T183E3F116D993986ECADB07388C7637ACE67935295781030F0F48542939B76EBCB47E32
sha3_384: bc371814603f76f2a21f80470d7b020ad1c9ee57789c351366184741ebf9b56242b136ede28f8a03c8dcc14f1c8ebbc3
ep_bytes: 558bec81c4b8fcffff488bd842e934fa
timestamp: 2007-03-18 07:01:02


Version Info:

CompanyName: Oper1 Software
FileDescription: Oper1 Internet Browser
FileVersion: 1190
InternalName: Oper1
LegalCopyright: Copyright © Oper1 Software 1995-2011
OriginalFilename: Oper1.exe
ProductName: Oper1 Internet Browser
ProductVersion: 11.01
Translation: 0x0409 0x04b0

Kazy.11649 also known as:

LionicHacktool.Win32.Krap.x!c
Elasticmalicious (high confidence)
DrWebTrojan.Packed.21467
MicroWorld-eScanGen:Variant.Kazy.11649
FireEyeGeneric.mg.4d24a003aeb6f6e2
McAfeePWS-Spyeye.ff
CylanceUnsafe
ZillyaTrojan.Kryptik.Win32.941078
SangforTrojan.Win32.Kryptik.8
K7AntiVirusTrojan ( 0055dd191 )
AlibabaTrojanPSW:Win32/Kryptik.93eefe52
K7GWTrojan ( 0055dd191 )
Cybereasonmalicious.3aeb6f
BitDefenderThetaGen:NN.ZexaF.34232.jq0@aeAxekjc
VirITTrojan.Win32.Packed.BFTR
SymantecW32.Qakbot!gen5
ESET-NOD32a variant of Win32/Kryptik.KRS
TrendMicro-HouseCallBKDR_QAKBOT.SMG
Paloaltogeneric.ml
KasperskyPacked.Win32.Krap.ae
BitDefenderGen:Variant.Kazy.11649
NANO-AntivirusTrojan.Win32.Diple.iejhi
SUPERAntiSpywareTrojan.Agent/Gen-Pervaser
AvastWin32:Renos-TI [Drp]
TencentWin32.Packed.Krap.Pdmi
Ad-AwareGen:Variant.Kazy.11649
TACHYONTrojan/W32.Diple.153088.C
EmsisoftGen:Variant.Kazy.11649 (B)
ComodoMalware@#2xnyd3eezi259
VIPRETrojan.Win32.Kryptik.lbu (v)
TrendMicroBKDR_QAKBOT.SMG
McAfee-GW-EditionPWS-Spyeye.ff
SophosML/PE-A + Mal/FakeAV-BW
IkarusTrojan.Win32.Crypt
GDataGen:Variant.Kazy.11649
JiangminTrojan/Diple.apt
AviraTR/Crypt.XPACK.Gen
Antiy-AVLTrojan/Generic.ASMalwS.1849754
GridinsoftRansom.Win32.Zbot.sa
ArcabitTrojan.Kazy.D2D81
ZoneAlarmPacked.Win32.Krap.ae
MicrosoftPWS:Win32/Zbot!ZA
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Zbot.C128053
Acronissuspicious
VBA32Trojan.Zeus.EA.0999
ALYacGen:Variant.Kazy.11649
MAXmalware (ai score=100)
APEXMalicious
RisingTrojan.Kryptik!8.8 (CLOUD)
YandexTrojan.Kryptik!KhfS2OYJhmU
SentinelOneStatic AI – Malicious PE
FortinetW32/Kryptik.NAS!tr
AVGWin32:Renos-TI [Drp]
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Kazy.11649?

Kazy.11649 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment