Malware

What is “Win32/GenKryptik.EEAE”?

Malware Removal

The Win32/GenKryptik.EEAE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/GenKryptik.EEAE virus can do?

  • Executable code extraction
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • A process created a hidden window
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Sniffs keystrokes
  • Crashed cuckoomon during analysis. Report this error to the Github repo.
  • A process attempted to delay the analysis task by a long amount of time.
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Creates a slightly modified copy of itself
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz
resolver1.opendns.com
myip.opendns.com
curlmyip.net
winserver-cdn.at

How to determine Win32/GenKryptik.EEAE?


File Info:

crc32: 2F4BE4E4
md5: bf416d5efb7efdb29ea5a18bddd239be
name: 1002.exe
sha1: b2f096cf9c6847fa0921939b21918b9484db51c6
sha256: 712a6fa0da2c744f07f108d5dbd144e06e2444f965fa8a2eeff9e7969527d3c6
sha512: 7d68d8700915726880a00220ed93b156b1bd1d6faae476b6cd9448e251f177274276e66aaaf4649c5c80f59faa3aa9a6c914a46337d9dafc47b13c370c048338
ssdeep: 12288:NcJdMKCvgX1t7FqWeSxT4p1aGFxWre57F5hbG5UCUZ0G/XAZGGJhg3SJxKF:bKCvgX1tEWeSKu+7F/MULn3KKF
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright xa9 2005-2019 Enginefoot Abovesugar
InternalName: foll.exe
FileVersion: 6.1.52.68
CompanyName: www.mindGolbase.com
LegalTrademarks: Ready Getline
Comments: Leadmore Wo needspoke four
ProductName: Ready Getline
ProductVersion: 6.1.52.68
FileDescription: Ready Getline
OriginalFilename: foll.exe
Translation: 0x0000 0x04b0

Win32/GenKryptik.EEAE also known as:

DrWebTrojan.DownLoader32.64139
MicroWorld-eScanGen:Variant.Johnnie.215600
FireEyeGeneric.mg.bf416d5efb7efdb2
Qihoo-360Win32/Trojan.c98
CylanceUnsafe
AegisLabTrojan.Multi.Generic.4!c
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderGen:Variant.Johnnie.215600
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.f9c684
AvastWin32:Malware-gen
GDataWin32.Trojan-Spy.Ursnif.ARJZPE
KasperskyTrojan-Banker.Win32.Cridex.ito
TencentWin32.Trojan-banker.Cridex.Phpx
Ad-AwareGen:Variant.Johnnie.215600
SophosMal/Generic-S
ComodoMalware@#h5bht8ptq17x
McAfee-GW-EditionArtemis!Trojan
EmsisoftGen:Variant.Johnnie.215600 (B)
IkarusTrojan-Spy.Win32.Ursnif
Endgamemalicious (high confidence)
ArcabitTrojan.Johnnie.D34A30
ZoneAlarmTrojan-Banker.Win32.Cridex.ito
MicrosoftTrojan:Win32/Wacatac.C!ml
McAfeeArtemis!BF416D5EFB7E
MAXmalware (ai score=85)
PandaTrj/GdSda.A
ESET-NOD32a variant of Win32/GenKryptik.EEAE
RisingMalware.Strealer!8.1EF (CLOUD)
SentinelOneDFI – Suspicious PE
FortinetW32/Cridex.ITO!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_60% (W)

How to remove Win32/GenKryptik.EEAE?

Win32/GenKryptik.EEAE removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment