Categories: Malware

Win32/GenKryptik.DGFO removal tips

The Win32/GenKryptik.DGFO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.DGFO virus can do?

Behavioural detection: Executable code extraction – unpacking
Uses Windows utilities for basic functionality
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Uses Windows utilities to create a scheduled task
CAPE detected the Fareit malware family
Deletes executed files from disk
Touches a file containing cookies, possibly for information gathering
Harvests credentials from local FTP client softwares
Harvests information related to installed mail clients
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/GenKryptik.DGFO?


File Info:
name: 6308FD00AD61AD6AF45C.mlwpath: /opt/CAPEv2/storage/binaries/88aa75d16cc6a299a901becadcff5925fa09e9ff9138af893614d8359cd0bda1crc32: 057603E5md5: 6308fd00ad61ad6af45ce1ba543e01acsha1: c80d2264b83772c5a5c3be62a10e97d5d24afdaesha256: 88aa75d16cc6a299a901becadcff5925fa09e9ff9138af893614d8359cd0bda1sha512: 5a1ab771697bcac7a272859a6d88ea79c02effdb7cbc42dc9cbb6287b90d2f125ee08da6d4a7787e847159bb03b192d91d1ac239d1d9048f905f17f5a7d6af53ssdeep: 12288:2GDifoOCNeUzVPALqtee7WKy1IJvEH5N96O3RMYWRt1QgA:2GyCNfVPALqteevyMugqsH1QgAtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T12FA45A28B550A427D023F0725712ED7112BEEF642A2ADC2FE78CFA0ADB7C541A631757sha3_384: 9867143f0803cac2276d64a5a19c0910fa692fd1cdea659b129ab4d723626aab0a17cdd1c23b70172c5c954cff8a4a09ep_bytes: e8fca40000e9000000006a146888fc44timestamp: 2019-04-23 19:59:26
Version Info:
FileDescription: Welcomed Unions Turff The Pc’sComments: Welcomed Unions Turff The Pc’sFileVersion: 5.5.5.9Languages: EnglishInternalName: Cpan RoughPrivateBuild: 5.5.5.9CompanyName: Emergency SoftOriginalFilename: Cpan Rough.exeLegalCopyright: (c) 2015 Company  Emergency SoftLegalTrademarks: (c) 2015 Company  Emergency SoftProductName: Cpan RoughProductVersion: 5.5.5.9Translation: 0x0409 0x04b0

Win32/GenKryptik.DGFO also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.APosT.4!c
AVG	Win32:PWSX-gen [Trj]
tehtris	Generic.Malware
Malwarebytes	Generic.Malware/Suspicious
Sangfor	Trojan.Win32.Apost.Vod6
K7AntiVirus	Trojan ( 0054cb8f1 )
Alibaba	Trojan:Win32/APosT.4647dd8d
K7GW	Trojan ( 0054cb8f1 )
Symantec	Trojan Horse
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.DGFO
Cynet	Malicious (score: 99)
APEX	Malicious
Kaspersky	Trojan.Win32.APosT.hek
NANO-Antivirus	Trojan.Win32.APosT.fpotyt
Avast	Win32:PWSX-gen [Trj]
Rising	Trojan.APosT!8.E271 (CLOUD)
Emsisoft	Trojan.Agent (A)
F-Secure	Trojan.TR/Crypt.ZPACK.gahgx
DrWeb	Trojan.PWS.Siggen2.12502
Zillya	Trojan.GenKryptik.Win32.29521
McAfee-GW-Edition	BehavesLike.Win32.NetLoader.gh
FireEye	Generic.mg.6308fd00ad61ad6a
Sophos	Mal/Generic-S
Jiangmin	Trojan.APosT.lr
Webroot	W32.Malware.Gen
Avira	TR/Crypt.ZPACK.gahgx
Antiy-AVL	Trojan/Win32.APosT
ViRobot	Trojan.Win.Z.Apost.478720
ZoneAlarm	Trojan.Win32.APosT.hek
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Malware/Win32.Generic.C3174155
McAfee	Artemis!6308FD00AD61
VBA32	BScope.Trojan.Propagate
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002H0CGV23
Tencent	Win32.Trojan.Apost.Majl
Ikarus	Trojan.Win32.Krypt
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/GenKryptik.DGFO!tr
BitDefenderTheta	Gen:NN.ZexaF.36348.Du0@aGzH2Xoi
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)