What is “Win32/GenKryptik.FONE”?

The Win32/GenKryptik.FONE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/GenKryptik.FONE virus can do?

Behavioural detection: Executable code extraction – unpacking
Dynamic (imported) function loading detected
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/GenKryptik.FONE?


File Info:
name: B9D6809F6D76D5B1E7A8.mlw
path: /opt/CAPEv2/storage/binaries/92f42d57f5492e6859b10c6f67a66831ceb4bec9fd17f409027d0d3d3c0ae8f0
crc32: 1EF0DB23
md5: b9d6809f6d76d5b1e7a861537d635f67
sha1: 430f45b932d52589da953662af84740cb6bc9775
sha256: 92f42d57f5492e6859b10c6f67a66831ceb4bec9fd17f409027d0d3d3c0ae8f0
sha512: 74db14d9c32ed3c8979793c44cc54de5ee076cc4ac3f538323200f9e9f6dbae9aa6dad6607c72863eb9dda43f5a7c6cba928b8339aaf885d8dca41ce2da2ef3e
ssdeep: 24576:0Zz16E4Rz0x8WnUbDTdrpRIG+K+WepLgEopz1FxNIC6lys/3wAdU:/E46QbD5L+jgEop1FxNIC6osvwV
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19C55AE63C6008121EC22BDB428546AD522253FFA6D1CF44FBB1DBE9CB9729D36878357
sha3_384: 343640740033c47e481361017e836350594d85e7a389227b10dfa5484b452d067857245f1c2ee3d291ef7e784e4ed873
ep_bytes: 6824464000e8eeffffff000000000000
timestamp: 2021-12-07 16:58:30

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Zaid Markabi
ProductName: RPG_ZAID
FileVersion: 1.00
ProductVersion: 1.00
InternalName: Game
OriginalFilename: Game.exe

Win32/GenKryptik.FONE also known as:

Lionic	Trojan.Win32.Androm.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.47633042
FireEye	Generic.mg.b9d6809f6d76d5b1
ALYac	Trojan.GenericKD.47633042
Cylance	Unsafe
K7AntiVirus	Trojan ( 0058ba801 )
K7GW	Trojan ( 0058ba801 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.FONE
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Backdoor.Win32.Androm.uxun
BitDefender	Trojan.GenericKD.47633042
Tencent	Win32.Backdoor.Androm.Pitq
Ad-Aware	Trojan.GenericKD.47633042
Emsisoft	Trojan.GenericKD.47633042 (B)
TrendMicro	TROJ_GEN.R067C0WLF21
McAfee-GW-Edition	BehavesLike.Win32.Sality.tc
Sophos	Mal/Generic-S
Paloalto	generic.ml
Webroot	W32.Trojan.Gen
Avira	TR/AD.Nanocore.ivjhw
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Backdoor:MSIL/Noancooe.C
GData	MSIL.Backdoor.Nancat.T8TMER
Cynet	Malicious (score: 99)
McAfee	Artemis!B9D6809F6D76
MAX	malware (ai score=84)
VBA32	Malware-Cryptor.VB.gen.1
Malwarebytes	Backdoor.NanoCore
TrendMicro-HouseCall	TROJ_GEN.R067C0WLF21
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	PossibleThreat.MU
AVG	Win32:Trojan-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Win32/GenKryptik.FONE?

Win32/GenKryptik.FONE removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X