Malware

How to remove “Mal/Generic-R + Troj/Kryptik-NK”?

Malware Removal

The Mal/Generic-R + Troj/Kryptik-NK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + Troj/Kryptik-NK virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Enumerates the modules from a process (may be used to locate base addresses in process injection)
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the RedLine malware family

How to determine Mal/Generic-R + Troj/Kryptik-NK?



File Info:

name: 929753B0CA6D3D311FDC.mlw
path: /opt/CAPEv2/storage/binaries/81989badd023cf3edf5ce46f3e7945df562f355021a9d2f154818d76fcb870e3
crc32: BE66E395
md5: 929753b0ca6d3d311fdc718e5b7d0bab
sha1: 430237e6b04e1d6c3492b1b39f8fcda8292f6ea2
sha256: 81989badd023cf3edf5ce46f3e7945df562f355021a9d2f154818d76fcb870e3
sha512: 86867f752ffd2e8cbfaf91db0861b027148768026615a50b8e74f5e09f020851fe232a2b778cbe6cc273e79dbfa5eca84d78cfb1b191aa96630035b7361ac428
ssdeep: 3072:q4L3IzWm1SLtY0ZPsCG1pIontZbprqq/DyD/K8E2kAWNFx+7SwH/0O7TsxqOTC37:bL3IvghY0q7PIoXbFqtDF/2y0xJi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1592402323DD09931C0CA457A50D0DA645ABA61B117E6528B3BBC1EBE9F323C1973B34B
sha3_384: a07364e8cbbcf044090619646e9f3c921f79e88d0ffe781d0d16c83de4f4e206beb62321b5012b7f06a19729e1dd2e99
ep_bytes: e8d3220000e979feffff8bff558bec8b
timestamp: 2019-05-24 10:46:00


Version Info:

Translations: 0x0159 0x0e0f

Mal/Generic-R + Troj/Kryptik-NK also known as:

BkavW32.AIDetect.malware1
LionicTrojan.Win32.Zenpak.trCx
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Heur.Mint.Dreidel.nqW@x4V!z5iO
FireEyeGeneric.mg.929753b0ca6d3d31
ALYacGen:Heur.Mint.Dreidel.nqW@x4V!z5iO
CylanceUnsafe
ZillyaTrojan.Kryptik.Win32.2689118
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005667d71 )
AlibabaTrojan:Win32/Glupteba.6d55316c
K7GWTrojan ( 005667d71 )
Cybereasonmalicious.0ca6d3
CyrenW32/Wacatac.CH.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HHLX
APEXMalicious
AvastWin32:TrojanX-gen [Trj]
ClamAVWin.Dropper.Tofsee-9890391-0
KasperskyHEUR:Trojan.Win32.Zenpak.pef
BitDefenderGen:Heur.Mint.Dreidel.nqW@x4V!z5iO
NANO-AntivirusTrojan.Win32.Zenpak.idlqix
SUPERAntiSpywareTrojan.Agent/Gen-Kryptik
TencentWin32.Trojan.Zenpak.Hssd
SophosMal/Generic-R + Troj/Kryptik-NK
DrWebTrojan.PWS.Siggen2.59798
VIPRETrojan.Win32.Generic!BT
TrendMicroBackdoor.Win32.GLUPTEBA.SMTH.hp
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
EmsisoftGen:Heur.Mint.Dreidel.nqW@x4V!z5iO (B)
Paloaltogeneric.ml
JiangminTrojan.Zenpak.ehg
WebrootW32.Malware.Gen
AviraHEUR/AGEN.1209904
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftTrojan:Win32/Glupteba.MI!MTB
ZoneAlarmHEUR:Trojan.Win32.Zenpak.pef
GDataGen:Heur.Mint.Dreidel.nqW@x4V!z5iO
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.MalPe.R353924
McAfeeLockbit-FSUC!929753B0CA6D
MAXmalware (ai score=85)
VBA32BScope.Trojan.Wacatac
MalwarebytesTrojan.MalPack.GS
TrendMicro-HouseCallBackdoor.Win32.GLUPTEBA.SMTH.hp
RisingMalware.Obscure!1.A3BB (CLOUD)
YandexTrojan.Zenpak!IFJ3B5WqkOs
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GenKryptik.EWTP!tr
BitDefenderThetaGen:NN.ZexaF.34182.nqW@a4V!z5iO
AVGWin32:TrojanX-gen [Trj]
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Mal/Generic-R + Troj/Kryptik-NK?

Mal/Generic-R + Troj/Kryptik-NK removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment