About “Trojan.Win32.VBKrypt.hzgk” infection

The Trojan.Win32.VBKrypt.hzgk is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Win32.VBKrypt.hzgk virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Binary compilation timestomping detected
• Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Trojan.Win32.VBKrypt.hzgk?

File Info:
name: EBA408FB6BEDAEB44FF6.mlw
path: /opt/CAPEv2/storage/binaries/33c01ad4bfc236bf0c36ab3cac4bbd5b59692866812d16c38fecf32946a0d812
crc32: 1FE5528D
md5: eba408fb6bedaeb44ff6d23ad64ca8c1
sha1: 86eb9bfaa031842326cca94b61c7653d2fea36c6
sha256: 33c01ad4bfc236bf0c36ab3cac4bbd5b59692866812d16c38fecf32946a0d812
sha512: e182caac8a93e1f86b08866426dca699445299fb37cb6a5ec068b70d29b75aa3cfef21a24831122e582fc6cb8e0a292d125d78c233d0f9749f19533cb5306ba4
ssdeep: 3072:Sk/gPrdVfWM8RM/8KmwBErXXFefQmD8ampj3ixw:P/UX8/KmwBEjXFeos8aCjix
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FB34C42E3691E13AC625CAF42D5A43A080BDAC3630D6AD17F7C21B1677F2D6B9350753
sha3_384: fd78cb637e336fde8aaeab9adf2e4403b90d094c82fe997a495a4e07f99f794e5c0117b81fbedae681efa711d42b4d4e
ep_bytes: 6820344000e8f0ffffff000000000000
timestamp: 2098-02-05 21:23:26

Version Info:
Translation: 0x0409 0x04b0
ProductName: BKTZjzCaPdATv
FileVersion: 1.00
ProductVersion: 1.00
InternalName: ShfwyJAk
OriginalFilename: ShfwyJAk.exe

Trojan.Win32.VBKrypt.hzgk also known as:

How to remove Trojan.Win32.VBKrypt.hzgk?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.