About “Win32/GenKryptik.GHKI” infection

The Win32/GenKryptik.GHKI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.GHKI virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Attempts to modify proxy settings
• Deletes executed files from disk
• Touches a file containing cookies, possibly for information gathering
• Collects information to fingerprint the system
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/GenKryptik.GHKI?

File Info:
name: 5662AC16B0B871174FF9.mlw
path: /opt/CAPEv2/storage/binaries/6f083622501ef1e4442c851147451acca629d27c75c3e827f492416f33c4e64e
crc32: 201F13E7
md5: 5662ac16b0b871174ff9c13b73aef0d0
sha1: de75b20bae37a8a5cab69f04d7b179588a5bbf1f
sha256: 6f083622501ef1e4442c851147451acca629d27c75c3e827f492416f33c4e64e
sha512: bb45aace3e4c64a82c4f6493589fc0d35748d9c9e13bc08b7bf011e30a52c2c2fc70bef5a98c812a1e0dbcdd9028c9e059c427ad21a7f073c821fe4616d77bd3
ssdeep: 12288:UTUJtpztd1J6L7ZfsiMaUhc8zkE16pSuke217jZEwQl1:/rpnDcby1612N1Ql1
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T192B4122EE3221B25DB8536F3A7B596CDF71CF3B8266396700484294D0066E3D8277D9B
sha3_384: 5194f14e9f769482c5359161fb5f88744c6c6edb6d3787a4161af6628d3abd6d6100c4140b821d759f1495f1b9c33c1e
ep_bytes: b8a0e65d00ffe04281ee0100000081c0
timestamp: 1971-05-16 00:00:00

Version Info:
0: [No Data]

Win32/GenKryptik.GHKI also known as:

How to remove Win32/GenKryptik.GHKI?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.