Win32/GenKryptik.EONM (file analysis)

The Win32/GenKryptik.EONM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.EONM virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process attempted to delay the analysis task.
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Tries to unhook or modify Windows functions monitored by Cuckoo
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
Checks the CPU name from registry, possibly for anti-virtualization
Harvests credentials from local FTP client softwares
Harvests information related to installed mail clients
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/GenKryptik.EONM?


File Info:
crc32: 10EB1B92
md5: ab4c1217935f026ffae7a6abd9a3ade5
name: Letter-07-24-2020.exe
sha1: ae6ffbc82cebc360eb6330a81bf9c0939c3b6484
sha256: 0851af08d99952725abad6b8848bf8229c8db04ea48e53d5c35d59229b746da7
sha512: 0fd2e2ed1270fdfd7119b9f2f9dc8a497bbadb7c7cc3cd5340db63136a37742eb06ff3f8fcd5506c146682f4bd8d199408ed32f587fa16274f4b67b7d58134cd
ssdeep: 12288:4IFIvtUFqW6lJMK5/ZCasg48z1IWPhetOLyH/iwjgK2Ddek2x08+9Yz7UYy8J:PktUD6lJMmsL8KWPc1pjgKZZ6OH9jJ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Win32/GenKryptik.EONM also known as:

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
FireEye	Generic.mg.ab4c1217935f026f
McAfee	Fareit-FVZ!AB4C1217935F
Cylance	Unsafe
Sangfor	Malware
BitDefender	Trojan.Delf.FareIt.Gen.7
Cybereason	malicious.82cebc
TrendMicro	TrojanSpy.Win32.LOKI.SMAD1.hp
BitDefenderTheta	Gen:NN.ZelphiF.34138.UGW@aCiMXFki
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
GData	Trojan.Delf.FareIt.Gen.7
Kaspersky	UDS:DangerousObject.Multi.Generic
Endgame	malicious (high confidence)
Emsisoft	Trojan.Delf.FareIt.Gen.7 (B)
Invincea	heuristic
Trapmine	malicious.moderate.ml.score
MAX	malware (ai score=83)
Microsoft	PWS:Win32/Fareit.AQ!MTB
Arcabit	Trojan.Delf.FareIt.Gen.7
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2091
Acronis	suspicious
ALYac	Trojan.Delf.FareIt.Gen.7
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/GenKryptik.EONM
TrendMicro-HouseCall	TrojanSpy.Win32.LOKI.SMAD1.hp
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Injector.EMOY!tr
Ad-Aware	Trojan.Delf.FareIt.Gen.7
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Win32/GenKryptik.EONM?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/GenKryptik.EONM (file analysis)