Categories: Malware

How to remove “Win32/GenKryptik.EMUI”?

The Win32/GenKryptik.EMUI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.EMUI virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
A process created a hidden window
Uses Windows utilities for basic functionality
Anomalous binary characteristics

How to determine Win32/GenKryptik.EMUI?


File Info:
crc32: 45EA987Amd5: 1f498b538c41c22731cde9f41cf92b32name: 1F498B538C41C22731CDE9F41CF92B32.mlwsha1: 10c78eba96fd5be058bd179f464e88e1478e6d44sha256: 61101e59c831732d3620689c3cf6ff3a0c302028866e109481e2fe31f5d6337esha512: 2e21d3fdbdc95fb98f90d4f0c9116e3924e70a3a78f32dbd920c60e857feba68ec4d62c17e9b16cdd8cbb245a462c95523c01de270031c504d31f9cd5c91228dssdeep: 12288:+huHpD2wwLHqpVxTBfGjuLPvfQAdIiftnI/4n:fpD2wwTefuuLPnz/ntype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.InternalName: FXSCOVER.EXEFileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)CompanyName: Microsoft CorporationProductName: Microsoftxae Windowsxae Operating SystemProductVersion: 6.1.7601.17514FileDescription: Microsoft  Fax Cover Page EditorOriginalFilename: FXSCOVER.EXETranslation: 0x0409 0x04b0

Win32/GenKryptik.EMUI also known as:

Bkav	W32.AIDetectVM.malwareB
K7AntiVirus	Riskware ( 0040eff71 )
Cynet	Malicious (score: 85)
ALYac	Trojan.GenericKDZ.68027
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (W)
Cybereason	malicious.a96fd5
TrendMicro	Backdoor.Win32.QAKBOT.SME
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.EMUI
APEX	Malicious
Avast	Win32:DangerousSig [Trj]
GData	Trojan.GenericKDZ.68027
Kaspersky	Trojan.Win32.Zenpak.ahxd
BitDefender	Trojan.GenericKDZ.68027
MicroWorld-eScan	Trojan.GenericKDZ.68027
Ad-Aware	Trojan.GenericKDZ.68027
Sophos	Troj/Qbot-FS
F-Secure	Trojan.TR/Kryptik.xsall
BitDefenderTheta	Gen:NN.ZexaF.34128.ME1@aK!AYRki
McAfee-GW-Edition	W32/PinkSbot-GW!1F498B538C41
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.1f498b538c41c227
Emsisoft	Trojan.GenericKDZ.68027 (B)
SentinelOne	DFI – Malicious PE
Endgame	malicious (high confidence)
Avira	TR/Kryptik.xsall
eGambit	PE.Heur.InvalidSig
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Wacatac.C!ml
Jiangmin	Trojan.Zenpak.cec
Arcabit	Trojan.Generic.D109BB
ZoneAlarm	Trojan.Win32.Zenpak.ahxd
AhnLab-V3	Trojan/Win32.Suspig.R340992
Acronis	suspicious
McAfee	W32/PinkSbot-GW!1F498B538C41
MAX	malware (ai score=88)
Malwarebytes	Trojan.Qbot
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Backdoor.Win32.QAKBOT.SME
Rising	Trojan.Kryptik!1.C745 (CLASSIC)
Ikarus	Trojan.Qakbot
Fortinet	W32/QBOT.CC!tr
AVG	Win32:DangerousSig [Trj]
Qihoo-360	HEUR/QVM19.1.0C99.Malware.Gen