Win32/GenKryptik.FBYQ removal tips

Malware Removal

The Win32/GenKryptik.FBYQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Win32/GenKryptik.FBYQ virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (3 unique times)
  • Creates RWX memory
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Slovak
  • The binary likely contains encrypted or compressed data.
  • Checks for the presence of known windows from debuggers and forensic tools
  • Installs itself for autorun at Windows startup
  • Attempts to identify installed AV products by installation directory
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Detects VirtualBox through the presence of a registry key
  • Anomalous binary characteristics

Related domains:

iplogger.org
paperships.top
ip-api.com

How to determine Win32/GenKryptik.FBYQ?


File Info:

crc32: 053394DB
md5: 110d994b7edc2aefca344e7640c7231c
name: 110D994B7EDC2AEFCA344E7640C7231C.mlw
sha1: 0104a6ccc795572625aea0dc0b79982a479d95df
sha256: 2ba5226823e923fc9395c6c2a7d3e4cd3bf037b30e637f0e7ca8c85dd71cb5d9
sha512: ee6511bdc8fc9cf26657546fc403aa9d97d151dbc41dfd51bd1078cbbab9cfa1d64ee14358d05b9e685463389ba1c48c38e7b14624f0864f9f0da7d097e1e8bc
ssdeep: 12288:kFg43mdnVRBA8dCiTQWKNXfKrSroffWlf8n/Xs1zXF6Z4LLuL:kKLBqc2WKNXfKrS4H/qXFUiLk
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Win32/GenKryptik.FBYQ also known as:

BkavW32.AIDetectGBM.malware.01
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.73097
FireEyeGeneric.mg.110d994b7edc2aef
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0056f9be1 )
BitDefenderTrojan.GenericKDZ.73097
K7GWTrojan ( 0056f9be1 )
CrowdStrikewin/malicious_confidence_60% (D)
CyrenW32/Kryptik.DHT.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:PWSX-gen [Trj]
KasperskyHEUR:Exploit.Win32.Shellcode.gen
Ad-AwareTrojan.GenericKDZ.73097
SophosMal/Generic-S
McAfee-GW-EditionBehavesLike.Win32.Generic.hc
EmsisoftTrojan.Crypt (A)
SentinelOneStatic AI – Malicious PE
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftTrojan:Win32/Glupteba!ml
ArcabitTrojan.Generic.D11D89
ZoneAlarmHEUR:Exploit.Win32.Shellcode.gen
GDataTrojan.GenericKDZ.73097
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.Generic.C4341101
Acronissuspicious
McAfeeRDN/RedLineStealer
MAXmalware (ai score=80)
ESET-NOD32a variant of Win32/GenKryptik.FBYQ
RisingTrojan.Kryptik!1.D250 (CLASSIC)
FortinetW32/Kryptik.HJNV!tr
AVGWin32:PWSX-gen [Trj]
Qihoo-360HEUR/QVM10.1.6A03.Malware.Gen

How to remove Win32/GenKryptik.FBYQ?

Win32/GenKryptik.FBYQ removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment