About “Win32/GenKryptik.GHKI” infection

The Win32/GenKryptik.GHKI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.GHKI virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• Attempts to modify proxy settings
• Deletes executed files from disk
• Touches a file containing cookies, possibly for information gathering
• Collects information to fingerprint the system
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/GenKryptik.GHKI?

File Info:
name: 9F268E711F4F3C70324F.mlw
path: /opt/CAPEv2/storage/binaries/957b70bcffe8ba05d62dc6643025ca6fca119451d822d77346b71ab237125266
crc32: 561073F5
md5: 9f268e711f4f3c70324fe0a3590185c3
sha1: 64c215be7d1681a43431481f2b8f6bb663c01550
sha256: 957b70bcffe8ba05d62dc6643025ca6fca119451d822d77346b71ab237125266
sha512: 94e70df466d588c71a70a9c4be242b8f7b4f7afae28a96bac027a0a950f13c68dc4733b6c1e009efa5d6b256e2a75bf8e966a62682ec36f9825e52c07b15e567
ssdeep: 12288:uqjZM3cZPTZ2S/yKWw7kMi8bdyX0HRxTtgHtmUkKF6fd2B05xrG2I:uWM3cVGkRTgNdkA6fUB05xrG2I
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T10AC4124B37880BA6D3DB32B3614A9D4BB60B29EA037E63F1206D953C111BE15E3B95D4
sha3_384: 561a44493ce8db8658237527ecc611426950d97248799723e4e6daa45780774affe61c602c922483f13c1cdb354f8ba4
ep_bytes: b8a0e65d00ffe04029f04081efaa39c8
timestamp: 1975-06-24 00:00:00

Version Info:
0: [No Data]

Win32/GenKryptik.GHKI also known as:

How to remove Win32/GenKryptik.GHKI?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.