Win32/GenKryptik.FOLV (file analysis)

The Win32/GenKryptik.FOLV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.FOLV virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Nepali
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Detects Sandboxie through the presence of a library
• Detects Avast Antivirus through the presence of a library
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Checks the presence of disk drives in the registry, possibly for anti-virtualization

How to determine Win32/GenKryptik.FOLV?

File Info:
name: AD3565ECA4F28B1D1971.mlw
path: /opt/CAPEv2/storage/binaries/c6ea0b1ceb4d12ba99bf384c1b9ad5791e8b674c4f9a777717e8471879b2f891
crc32: A95182ED
md5: ad3565eca4f28b1d19719ed68c1d83fb
sha1: d347c523501e97f0a7e942a74b1fc54c16b49d60
sha256: c6ea0b1ceb4d12ba99bf384c1b9ad5791e8b674c4f9a777717e8471879b2f891
sha512: 2ccc37f1b77ac1440fe98754c07786235b9a6533ac637457cfe51318f5f12ac5292df136505e5d94db5f2ec493c24c9221c9ea302628828461ca40f1ac65e0e2
ssdeep: 3072:SqtEJasjWMdIqKZgui9ZFmJiMlkSKgZVVhzDVDKzxxL3/WHKnsT5k3zunzQE/P5R:3+JDWF1mZIlBZVrDVuTTOTG7EtZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18654AD2133D0C432D49325768925CBB58E7AB4712A2A6ACBFBC41FBD9F247D1973530A
sha3_384: 85f9d0ead7af56dd9337d09e618f1ef7a515926aee9f7b82d1184c0697cb035758af8a85de1fab458c5cde6dce1bb0bd
ep_bytes: e86f890000e978feffff8bff558bec83
timestamp: 2021-01-09 20:13:47

Version Info:
FileVers: 7.0.4.34
ProductVersa: 7.0.25.71
InternalName: eaLatemas
LegalCopyrighd: Jdfglsdffa
Translations: 0x0169 0x0301

Win32/GenKryptik.FOLV also known as:

How to remove Win32/GenKryptik.FOLV?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.