Troj/Krypt-GD malicious file

The Troj/Krypt-GD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Troj/Krypt-GD virus can do?

Authenticode signature is invalid
CAPE detected the DCRat malware family

How to determine Troj/Krypt-GD?


File Info:
name: C4426947C9922BEE205A.mlw
path: /opt/CAPEv2/storage/binaries/e48d645ff549cb6ed138c426c699c87823426512714bbdfe18f4e777c71f95ac
crc32: B70C39F7
md5: c4426947c9922bee205a02a5a16f10e2
sha1: ebec1950a798d9ba60922c9b7e51cdde6bb77d3f
sha256: e48d645ff549cb6ed138c426c699c87823426512714bbdfe18f4e777c71f95ac
sha512: c70210e21f1cc5ad80696ead6eca8f62ad0d160d4eed5033fc0e168194ea2bbd6856537124d8bab0fcc7985eca57f186456bc3a5843b34b12b1c63d3883640c9
ssdeep: 12288:+qnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:++ORToOWSi5gBoS4wYUJ0eo2
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B005C6342EEA1029F177AF7D9AE03596DA6FB66337079A4D1461038A0723B41EDC163F
sha3_384: 29fe82e50bf6ba9349008ef86ffc84563291d29c39ae7c7271948aa8e612ca7396d74f08e7356487a9a10b49cf8ef719
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-11-15 00:15:12

Version Info:
ProductName: 1i4c9z
CompanyName: O6Y
InternalName: hanL1eOxOWuOo5WfZrDDn4MgmH.exe
LegalCopyright: 5qd4xSPGOFSniIX
Comments: bVTW0fFfc2UDxXKVz7
OriginalFilename: Tswc6SnHiG.exe
ProductVersion: 0.374.131.823
FileVersion: 811.910.488.678
Translation: 0x0409 0x0514

Troj/Krypt-GD also known as:

DrWeb	BackDoor.DarkCrystal.99
MicroWorld-eScan	Trojan.GenericKD.61340052
ClamAV	Win.Packed.Uztuby-9891175-0
CAT-QuickHeal	Backdoor.MsilFC.S27868971
ALYac	Trojan.GenericKD.61340052
Malwarebytes	Generic.Spyware.Stealer.DDS
VIPRE	Trojan.GenericKD.61340052
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0058c6a91 )
K7GW	Trojan ( 0058c6a91 )
Cybereason	malicious.7c9922
BitDefenderTheta	Gen:NN.ZemsilF.36196.Xm0@a4LaGtbi
VirIT	Trojan.Win32.MSIL.LY
Cyren	W32/LightStone.B.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	MSIL/Spy.Agent.AES
Zoner	Trojan.Win32.143545
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Backdoor.MSIL.LightStone.gen
BitDefender	Trojan.GenericKD.61340052
Avast	Win32:RATX-gen [Trj]
Tencent	Backdoor.Win32.Lightstone.wa
Emsisoft	Trojan.GenericKD.61340052 (B)
F-Secure	Heuristic.HEUR/AGEN.1327341
TrendMicro	Backdoor.MSIL.DCRAT.SMAS
McAfee-GW-Edition	BehavesLike.Win32.AgentTesla.bm
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.c4426947c9922bee
Sophos	Troj/Krypt-GD
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor.MSIL.fikz
Avira	HEUR/AGEN.1327341
MAX	malware (ai score=88)
Antiy-AVL	Trojan[Spy]/MSIL.Agent
Microsoft	Trojan:MSIL/SpyNoon!atmn
Arcabit	Trojan.Generic.D3A7F994
ZoneAlarm	HEUR:Backdoor.MSIL.LightStone.gen
GData	Trojan.GenericKD.61340052
Google	Detected
AhnLab-V3	Trojan/Win.PWS.R462976
Acronis	suspicious
McAfee	AgentTesla-FDBQ!C4426947C992
TACHYON	Backdoor/W32.DN-LightStone.802816
VBA32	Dropper.MSIL.gen
Cylance	unsafe
Panda	Trj/CI.A
Rising	Backdoor.DCRat!1.D886 (CLASSIC)
Ikarus	Trojan.MSIL.Spy
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.AES!tr
AVG	Win32:RATX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Troj/Krypt-GD?

Troj/Krypt-GD removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X