VBKrypt.59 removal tips

The VBKrypt.59 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VBKrypt.59 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Mimics the system’s user agent string for its own requests
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• Performs HTTP requests potentially not found in PCAP.
• Starts servers listening on 0.0.0.0:36423, :0, 127.0.0.1:28557
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Code injection with CreateRemoteThread in a remote process
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Created a process from a suspicious location
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Attempts to modify proxy settings
• Collects information to fingerprint the system

How to determine VBKrypt.59?

File Info:
name: A9BD8CCA9186ECEEEA4D.mlw
path: /opt/CAPEv2/storage/binaries/63d92ba8a450c5e28cbb83f994d1373d7264869dfc8ff16a4fccf2f4899fe7e3
crc32: 5C9ADB47
md5: a9bd8cca9186eceeea4dddd0d3126ca2
sha1: e0d6774b098f105bb42e961be60079bfc3cecfc4
sha256: 63d92ba8a450c5e28cbb83f994d1373d7264869dfc8ff16a4fccf2f4899fe7e3
sha512: ab9fc785bfa0c1bea2b1729304113f6e3f5fa52c4032d4d60858eb72adc2089fc4c64d64f86701ab282161d53805bac0e3cba6dc8643a180f8c7bd48b10f0d25
ssdeep: 3072:tBbpPIpuf1g6bA3b6AJAdrnuWbV05l4nzNbhCDOTYTRlNZ32LD6ijFcdk6A+4y0X:tPD1cGxNbh/QR/oL2ESK7y0KKaxYnAx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BE5402C2F5683827D95E0AF44AF3CA58CE3538508E1A5BB35A89F67E0736741067BF06
sha3_384: d5a837351d3a3b0783fdd56d4ea379b9fd83bb96811d90b157e1dff330b71f07a9eae2688c68db5fe5b7ea0d4d24cb8b
ep_bytes: 68480b4400e8eeffffff000000000000
timestamp: 2015-02-19 19:58:20

Version Info:
Translation: 0x0409 0x04b0
ProductName: Kaonda4
FileVersion: 4.03.0008
ProductVersion: 4.03.0008
InternalName: Bojeva
OriginalFilename: Bojeva.exe

VBKrypt.59 also known as:

How to remove VBKrypt.59?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.