Win32/GenKryptik.ECNA removal instruction

The Win32/GenKryptik.ECNA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/GenKryptik.ECNA virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Network activity detected but not expressed in API logs

How to determine Win32/GenKryptik.ECNA?


File Info:
crc32: B7EE265C
md5: 924ded4431a9d54daa7038464c35f2d2
name: setup.exe
sha1: f19cc92446d409c2930ad41ad7b3e25b66238abf
sha256: 30ea2dd76e082071cffd7001e8d6fc339e3ebf8bf38ba1f0d402ed01daa5b7ca
sha512: bcd0ac2e89f9609695ebc82ffc24bf7966c38281a21467c383fc1f8e1a2718b69a9094e4c75d1edf8bbb6359753faa2eb777af0d375c53333703c1d237297686
ssdeep: 24576:129ZJlW2SttrMnuA6kBBzA9I3BSGnmNqWakqpXiGLJp2qI/:8ZJlW2SbM/f09I3BSpwKqpyGNp2qI/
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: Azure 2006-2014 (c)
CompanyName: Azure
LegalTrademarks: Azure 2006-2014 (c)
Comments: Uncharacteristically Disadvantage
ProductName: Enabled
ProductVersion: 5.7.12.8
FileDescription: Uncharacteristically Disadvantage
OriginalFilename: Enabled
Translation: 0x0409 0x04b0

Win32/GenKryptik.ECNA also known as:

MicroWorld-eScan	Trojan.GenericKD.32974219
FireEye	Generic.mg.924ded4431a9d54d
McAfee	RDN/Generic.hra
Cylance	Unsafe
AegisLab	Trojan.Win32.Generic.4!c
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.32974219
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.446d40
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZexaF.34084.5mKfaSbKMOmi
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
GData	Trojan.GenericKD.32974219
Rising	Trojan.Kryptik!8.8 (CLOUD)
Endgame	malicious (moderate confidence)
F-Secure	Trojan.TR/Kryptik.twcja
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Possible_HPGen-38
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Trapmine	malicious.moderate.ml.score
Emsisoft	Trojan.GenericKD.32974219 (B)
Ikarus	Win32.Outbreak
eGambit	Unsafe.AI_Score_97%
Avira	TR/Kryptik.twcja
Webroot	W32.Adware.Installcore
Arcabit	Trojan.Generic.D1F7258B
Microsoft	Trojan:Win32/Wacatac.C!ml
Acronis	suspicious
ALYac	Trojan.GenericKD.32974219
MAX	malware (ai score=81)
Malwarebytes	Trojan.Loader
ESET-NOD32	a variant of Win32/GenKryptik.ECNA
TrendMicro-HouseCall	Possible_HPGen-38
SentinelOne	DFI – Suspicious PE
Fortinet	W32/Kryptik.GVSM!tr
Ad-Aware	Trojan.GenericKD.32974219
AVG	Win32:Trojan-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Win32/GenKryptik.ECNA?

Win32/GenKryptik.ECNA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X