Win32/GenKryptik.FYDG removal guide

The Win32/GenKryptik.FYDG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.FYDG virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Checks adapter addresses which can be used to detect virtual network interfaces
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Kannada
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Attempts to modify proxy settings

How to determine Win32/GenKryptik.FYDG?

File Info:
name: 626F275CCDE225043142.mlw
path: /opt/CAPEv2/storage/binaries/34056ce7a3fe0cfc8d0dc8ec34783792ececcafcbc47be9e09e15363d09fb333
crc32: 0F2A92BD
md5: 626f275ccde225043142a633d1aef417
sha1: 3901d2a7961b4ae82d648e2dc466fd7c1be45084
sha256: 34056ce7a3fe0cfc8d0dc8ec34783792ececcafcbc47be9e09e15363d09fb333
sha512: de3c07da03282b48e94252aa6723407e09d19fddd08e51befd3edc48e1427c750490cdc1a006e9b8323d1a629d7bbeb7d4668797f2de6aa2a276c237d6e87c45
ssdeep: 3072:G5rIb0RJaV9HOv7QqX7JvTMX/SkUwe1+zMJCyC/eaxl1xunVhobtJ0uLE7LvfXvk:1eysQqrJr35wetUMa/KsQzffsnIJZzS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14B34D01077E0FC31D0E35A30A8B1D6A16E7B7C126A75448BB7543B2A7E717C0AA753A3
sha3_384: 29e962ef6fe0f03bf2a51192d21e2880c37b4e12694209d375ba9111985be2f1c7dfc58e8d288f99fba9e63faf796bfb
ep_bytes: e839510000e989feffffcccccccccccc
timestamp: 2021-12-31 16:06:34

Version Info:
FileVersions: 48.90.12.34
Copyrighz: Copyright (C) 2022, pozkarte
ProjectVersion: 84.64.75.52

Win32/GenKryptik.FYDG also known as:

How to remove Win32/GenKryptik.FYDG?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.