Spy

Spyware.KryptonStealer removal

Malware Removal

The Spyware.KryptonStealer is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Spyware.KryptonStealer virus can do?

  • Possible date expiration check, exits too soon after checking local time
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Steals private information from local Internet browsers
  • A process sent information about the computer to a remote location.
  • Collects information about installed applications
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Contacts C&C server HTTP check-in (Banking Trojan)
  • Attempts to access Bitcoin/ALTCoin wallets
  • Harvests credentials from local FTP client softwares
  • Harvests information related to installed instant messenger clients

How to determine Spyware.KryptonStealer?


File Info:

crc32: E0FD3446
md5: 3ce9f8409db88dd885adf957680e8e3c
name: 3CE9F8409DB88DD885ADF957680E8E3C.mlw
sha1: f88f28cd49b8f2aa7eaee4b1ae840679c37bb62e
sha256: 35cc9403db2b12cb186c02f48fed8ffdeb31fc28de8a7d1192e1158f1039a47e
sha512: 483e3326f8f8df5c80e0c46f3162d7ecf8c0bce16095f2f82c453c5fc0164c672158d46591222a402911a7acca64a326ebaa211afb77fb9a17af6f795d955245
ssdeep: 49152:yO0MpsaP9HiSelj9lohBKCt8wLJ0yfp4soHGRArgDl+B:yO+M1qlohBpt9LJvm3HG
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Spyware.KryptonStealer also known as:

BkavW32.AIDetectVM.malware
DrWebTrojan.PWS.Siggen2.46800
MicroWorld-eScanGen:Variant.Johnnie.239326
ALYacGen:Variant.Johnnie.239326
AlibabaTrojanSpy:Win32/Generic.8cd5b367
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Spy.Agent.PWS
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Malware.Fugrafa-7779079-0
GDataGen:Variant.Johnnie.239326
KasperskyUDS:DangerousObject.Multi.Generic
BitDefenderGen:Variant.Johnnie.239326
Ad-AwareGen:Variant.Johnnie.239326
F-SecureHeuristic.HEUR/AGEN.1130749
BitDefenderThetaGen:NN.ZexaCO.34108.fwW@a85QKdni
McAfee-GW-EditionBehavesLike.Win32.Generic.vh
FireEyeGen:Variant.Johnnie.239326
EmsisoftGen:Variant.Johnnie.239326 (B)
AviraHEUR/AGEN.1130749
Antiy-AVLTrojan/Win32.ParasiteStealer.a
MicrosoftPWS:Win32/Fareit.L!MTB
ArcabitTrojan.Johnnie.D3A6DE
ZoneAlarmUDS:DangerousObject.Multi.Generic
McAfeeGenericRXAA-AA!3CE9F8409DB8
MAXmalware (ai score=83)
VBA32BScope.TrojanSpy.Stealer
MalwarebytesSpyware.KryptonStealer
PandaTrj/GdSda.A
RisingStealer.Krypton!1.B834 (CLOUD)
IkarusTrojan-Spy.Agent
FortinetW32/Agent.PWS!tr.pws
AVGWin32:Trojan-gen

How to remove Spyware.KryptonStealer?

Spyware.KryptonStealer removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment