Win32/GenKryptik.FIWQ (file analysis)

The Win32/GenKryptik.FIWQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.FIWQ virus can do?

Executable code extraction
Creates RWX memory
Detected script timer window indicative of sleep style evasion
A process attempted to delay the analysis task.
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Singapore)
A scripting utility was executed
Uses Windows utilities for basic functionality
Sniffs keystrokes
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

resener.duckdns.org

How to determine Win32/GenKryptik.FIWQ?


File Info:
crc32: EA1FF3C4
md5: cebd70129181b2d00175a09425028661
name: CEBD70129181B2D00175A09425028661.mlw
sha1: 6412c81a57eb3e491d140cbb10b507b8f5086421
sha256: b0e0893c4a07b3a6c42c33988741f24c283be68927f79e0388e30d91eed7e2c2
sha512: c9bea381d1f87ff4715acaccbe75cbb834374b00324699f0eff6c76a019f2f933efb780fdd7efac48b30a47514ae910798c3f85013cd038692ef78d5007d647b
ssdeep: 6144:KN4z5x2rNAo0eQ2sCTQ6UGSeywoFaVt4Co5pZRtW2JrMNk:jz5Aqo0eQOTQ6N0nQt4j/ZO2Jrkk
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x020b 0x052b

Win32/GenKryptik.FIWQ also known as:

Elastic	malicious (high confidence)
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.FIWQ
APEX	Malicious
Avast	FileRepMalware
Cynet	Malicious (score: 100)
Kaspersky	UDS:Trojan.Win32.Chapak.gen
Sophos	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZexaF.34058.tuW@ayBbiTcH
McAfee-GW-Edition	BehavesLike.Win32.Emotet.fh
FireEye	Generic.mg.cebd70129181b2d0
SentinelOne	Static AI – Suspicious PE
Webroot	W32.Trojan.Gen
eGambit	Unsafe.AI_Score_97%
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Acronis	suspicious
McAfee	Packed-GDT!CEBD70129181
Rising	Malware.Obscure/Heur!1.A89F (CLASSIC)
Ikarus	Win32.Outbreak
AVG	FileRepMalware
Paloalto	generic.ml
Qihoo-360	HEUR/QVM10.1.3A6F.Malware.Gen

How to remove Win32/GenKryptik.FIWQ?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/GenKryptik.FIWQ (file analysis)