Malware

Win32/GenKryptik.EAFP removal guide

Malware Removal

The Win32/GenKryptik.EAFP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/GenKryptik.EAFP virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Starts servers listening on 127.0.0.1:32767, 127.0.0.1:32768
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Nepali
  • The binary likely contains encrypted or compressed data.
  • Looks up the external IP address
  • Queries information on disks, possibly for anti-virtualization
  • Sniffs keystrokes
  • Creates a hidden or system file
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
api.ipify.org
time-a.nist.gov

How to determine Win32/GenKryptik.EAFP?


File Info:

crc32: 229EC668
md5: 459d1f3ad747e1184d0c321f127e1a1b
name: atx555mx.exe
sha1: d77710af50c4cded7adfb5a5739164ca3f03206a
sha256: 617b7359d41a35b7d56b2e1a439aa1240de6c882829192a3f88049f86f724061
sha512: dd0820d773814f8dafd1108596ca97c4ba93c3b90858836f7d4e22963063b2fd187fdb0be75e23e85d972a0fb6e2d561722ada112855e641ed98ac0c0f24f284
ssdeep: 12288:MCxoohXi8iT+qkHTAl8X0X9tEraFpA2vjqC:MmHZAeXmtErGA2vW
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Win32/GenKryptik.EAFP also known as:

CAT-QuickHealRansom.Stop.MP4
McAfeeArtemis!459D1F3AD747
SangforMalware
Cybereasonmalicious.f50c4c
ESET-NOD32a variant of Win32/GenKryptik.EAFP
APEXMalicious
KasperskyUDS:DangerousObject.Multi.Generic
RisingDownloader.Dofoil!8.322 (TFE:6:qFwI1sROWJO)
Endgamemalicious (high confidence)
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Generic.gc
FireEyeGeneric.mg.459d1f3ad747e118
SentinelOneDFI – Malicious PE
ZoneAlarmUDS:DangerousObject.Multi.Generic
MicrosoftTrojan:Win32/Wacatac.B!ml
MalwarebytesRansom.Stop
IkarusRansom.Win32.Shade
BitDefenderThetaGen:NN.ZexaF.33550.BCW@aSY3KamG
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360HEUR/QVM10.1.E667.Malware.Gen

How to remove Win32/GenKryptik.EAFP?

Win32/GenKryptik.EAFP removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment