Categories: Malware

Win32/GenKryptik.FZHE removal guide

The Win32/GenKryptik.FZHE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.FZHE virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Drops a binary and executes it
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Checks for the presence of known windows from debuggers and forensic tools
CAPE detected the EnigmaStub malware family
Checks for the presence of known devices from debuggers and forensic tools
Checks for the presence of known devices from debuggers and forensic tools
Harvests cookies for information gathering
Anomalous binary characteristics

How to determine Win32/GenKryptik.FZHE?


File Info:
name: FB0DFF156717B9DD33E7.mlwpath: /opt/CAPEv2/storage/binaries/22d702adb12ab3b8e9debdfce7e37291ebed8c59ef16edfafc7cd94cb957164ecrc32: F1A26D33md5: fb0dff156717b9dd33e7deb806d3fe85sha1: 33fb85a8150acf848205b27dc905c5f2bbbf2789sha256: 22d702adb12ab3b8e9debdfce7e37291ebed8c59ef16edfafc7cd94cb957164esha512: 3f696afd516bb510fa4c109430bbbc247b7a1bf83d87b34ed4cf22df1671a8c5e9eaf77a509b98660acb177590dffcff30447110abb33faf63d3f90085912111ssdeep: 49152:B8nmNApBeUYYMsoJR14aK8FVR1gZk4qAVZS/XcxOb:B8m8e5/14C4ZS/XJtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E1B53362EB54C538FA0C8231FCC411F69A6DAD47A8789B9F13E23DD536B716E2D0094Esha3_384: d0485a0b70bd270d17cbf8e7aaee2ca3b6af910222e03562ed4949354e4d777c002cfbad12ee2bafef5e234e0b94a6aaep_bytes: eb0800e604000000000060e800000000timestamp: 2011-07-03 09:05:04
Version Info:
CompanyName: The Enigma Protector Developers TeamFileDescription: Software Protection ToolFileVersion: 1.0.7.13InternalName: ENIGMA.EXELegalCopyright: Copyrights (C) 2002-2009 Vladimir SukhovLegalTrademarks: Trademarks (R) 2002-2009 Vladimir SukhovOriginalFilename: enigma.exeProductName: The Enigma ProtectorProductVersion: 1.0.0.0Comments: http://enigmaprotector.com/Translation: 0x0409 0x04b0

Win32/GenKryptik.FZHE also known as:

Bkav	W32.AIDetect.malware1
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Ransom.385
FireEye	Generic.mg.fb0dff156717b9dd
Cylance	Unsafe
VIPRE	Gen:Variant.Ransom.385
Cybereason	malicious.56717b
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.FZHE
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.APosT.gen
BitDefender	Gen:Variant.Ransom.385
Ad-Aware	Gen:Variant.Ransom.385
Sophos	Generic ML PUA (PUA)
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Ransom.385 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Ransom.385
Arcabit	Trojan.Ransom.385
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R513176
BitDefenderTheta	Gen:NN.ZexaF.34682.xI0@aui7Yjni
ALYac	Gen:Variant.Ransom.385
MAX	malware (ai score=85)
Malwarebytes	Malware.AI.3446493965
Zoner	Probably Heur.ExeHeaderL
MaxSecure	Trojan.Malware.300983.susgen