Categories: Malware

MSIL/GenKryptik.FCGK malicious file

The MSIL/GenKryptik.FCGK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/GenKryptik.FCGK virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Injection with CreateRemoteThread in a remote process
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
Reads data out of its own binary image
A process created a hidden window
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Attempts to remove evidence of file being downloaded from the Internet
Executed a process and injected code into it, probably while unpacking
A process was set to shut the system down when terminated
Installs itself for autorun at Windows startup
Exhibits behavior characteristic of Nanocore RAT
Creates a copy of itself
Collects information to fingerprint the system

Related domains:

sylviaoslh01.ddns.net

How to determine MSIL/GenKryptik.FCGK?


File Info:
crc32: 7829517Fmd5: 0b89621a34f7359499e142f0e369705cname: 0B89621A34F7359499E142F0E369705C.mlwsha1: 825b84a41a03cc08c1256d0e11d8e44c72aa0c9dsha256: 9d33f9a53d4bdefea860069e931db24d15c237e759e980d4a223d5374c539eb5sha512: bcb8d2cc16abe40a7c308d8b592f64cf4b7c414cf1acbfabf120afd53ebf0ca2d7e63a6db5b78086aa87f43efb86fbfb6129cc992a0b544e70c6b3a279c70f20ssdeep: 12288:+FRIx8Iymn9+Drc4XLp6XAvter6EFXvqFQN33qyefSiyyjK:V8IwDfXLpVvAr6Eh4SnFgd8type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Version Info:
Translation: 0x0000 0x04b0LegalCopyright: Copyright xa9  2018 - 2021Assembly Version: 1.0.0.0InternalName: Sx637Ze1dyx6ccqR.exeFileVersion: 1.0.0.0CompanyName: LegalTrademarks: Comments: ProductName: Desktop ShapeProductVersion: 1.0.0.0FileDescription: Desktop ShapeOriginalFilename: Sx637Ze1dyx6ccqR.exe

MSIL/GenKryptik.FCGK also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.InjectNET.14
FireEye	Generic.mg.0b89621a34f73594
McAfee	Artemis!0B89621A34F7
Cylance	Unsafe
Cybereason	malicious.41a03c
BitDefenderTheta	Gen:NN.ZemsilF.34590.1m0@aa1WBjd
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.NanoBot.gen
F-Secure	Trojan.TR/AD.Nanocore.iqjzf
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Avira	TR/AD.Nanocore.iqjzf
ZoneAlarm	HEUR:Backdoor.MSIL.NanoBot.gen
GData	MSIL.Backdoor.Nancat.DJ85WR
AhnLab-V3	Trojan/Win32.AgentTesla.R368390
Malwarebytes	Malware.AI.784519854
ESET-NOD32	a variant of MSIL/GenKryptik.FCGK
Yandex	Trojan.AvsArher.bSIdr7
eGambit	Unsafe.AI_Score_100%
Fortinet	Malicious_Behavior.SB
AVG	Win32:MalwareX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	HEUR/QVM03.0.9617.Malware.Gen