Categories: Malware

MSIL/Kryptik.KDG (file analysis)

The MSIL/Kryptik.KDG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Kryptik.KDG virus can do?

Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Unconventionial language used in binary resources: Russian
Uses Windows utilities for basic functionality
Creates a hidden or system file
Network activity detected but not expressed in API logs
Detects VirtualBox through the presence of a file
Detects VMware through the presence of a file
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

How to determine MSIL/Kryptik.KDG?


File Info:
crc32: D2C1EC25md5: 4a5f2f1f3f38fc6e3c9b6a746e1e0857name: autokliker.exesha1: 2d8aaea4b525b475e66679d1b0e498a6c003b72esha256: 8c13bccbda4ac9cd36d52a8205e7068834a51989ed55bd152cacca38ca1ec2fcsha512: 2d79d6832f54615e57cfeff55d7796626df3f7d4674432fd4396286efcb8e51d8f95e12eef5963c7d03935f1b651ee39e75e6465481e4370d84682ef5644e345ssdeep: 98304:9Xz+qeHoUCmGYvVnsxOqDP3fJNzui29fiJ0c+5HRN73jREMdQsbN72Fnj/mOrTpx:FKqt/mVVnsf3BNChu0cSNDjREUQsctiytype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: xa0                                                                                                   FileDescription: x41fx440x438x43box436ex43dx438exa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0xa0FileVersion: 1.00                Comments: CompanyName: xa0                                                           Translation: 0x0409 0x04e4

MSIL/Kryptik.KDG also known as:

MicroWorld-eScan	Trojan.GenericKD.12559674
McAfee	Artemis!4A5F2F1F3F38
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.12559674
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.f3f38f
TrendMicro	TROJ_GEN.R057C0GCT20
Symantec	ML.Attribute.HighConfidence
TotalDefense	Win32/Jorik.KJ
APEX	Malicious
Paloalto	generic.ml
GData	Trojan.GenericKD.12559674
Kaspersky	HEUR:Trojan.MSIL.Generic
NANO-Antivirus	Riskware.Win32.MAgentKill.ejvwcr
Ad-Aware	Trojan.GenericKD.12559674
Sophos	Generic PUA NM (PUA)
F-Secure	Heuristic.HEUR/AGEN.1000541
DrWeb	Trojan.MulDrop7.25239
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Dropper.rc
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.4a5f2f1f3f38fc6e
Emsisoft	Trojan.GenericKD.12559674 (B)
Ikarus	Trojan.BAT.RA
Cyren	W32/Trojan.SW.gen!Eldorado
Jiangmin	TrojanSpy.SpyEyes.myc
MaxSecure	Trojan-Ransom.Win32.Crypmod.zfq
Avira	HEUR/AGEN.1000541
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Win32.BTSGeneric
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.DBFA53A
ZoneAlarm	HEUR:Trojan.MSIL.Generic
Microsoft	Trojan:Win32/Tiggre!rfn
ALYac	Trojan.GenericKD.12559674
Panda	Trj/CI.A
ESET-NOD32	a variant of MSIL/Kryptik.KDG
TrendMicro-HouseCall	TROJ_GEN.R057C0GCT20
Rising	Malware.Undefined!8.C (CLOUD)
SentinelOne	DFI – Suspicious PE
Fortinet	Riskware/MAgentKill
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (D)
Qihoo-360	Win32/Virus.RiskTool.4ef