Malware

About “Win32/GenKryptik.GJUU” infection

Malware Removal

The Win32/GenKryptik.GJUU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/GenKryptik.GJUU virus can do?

  • Sample contains Overlay data
  • Presents an Authenticode digital signature
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • CAPE detected the RedLine malware family
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/GenKryptik.GJUU?



File Info:

name: 533BFE54EF87D23A593D.mlw
path: /opt/CAPEv2/storage/binaries/29c85a7468e0ba42d6f77c610ea57eeb01f7286126d191dad9ce9d9170e86658
crc32: 27AB2890
md5: 533bfe54ef87d23a593dac5a50b57241
sha1: 666fd4028e74c4e073f9c276293b5f7fe2ac33b4
sha256: 29c85a7468e0ba42d6f77c610ea57eeb01f7286126d191dad9ce9d9170e86658
sha512: 1d0b10ae3861fb41dea31bb0e0f392c98cf4c441673c46e30b2907263f25d0af507bcd7f9ed457b97f7d8ee5406d68909f5c15535383b63acf1927f4a73172c0
ssdeep: 6144:q6Dje7Oz5FAPRbZDLFCkBlN0jVlM6tIzDW+9lEnQ2m3/R:5DyODAJbZH8kB8jnM6tIW+/EnQ2
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1FB64DF21264CC07AE45B28718AD9DB358AB9B4301B6F51DBB7C9476D1F217E2BB3430B
sha3_384: 1bb2eca3191116398ad9f0f35e402d796531e6f62d9ca84d0dac71fbfea86ff793dc4002f40233f6e8020c51783b3f75
ep_bytes: e835680000e9a4feffff6a0c68b04c42
timestamp: 2023-05-26 07:12:12


Version Info:

Comments: MyVJp5v62bJ1ZOZQw3RnlgdUDpJuv5
CompanyName: Uber Technologies, Inc.
FileDescription: Uber Technologies, Inc. Product
FileVersion: 7,532,25,434
InternalName: VQ96oMANyZ
LegalCopyright: Copyright © Uber Technologies, Inc. All rights reserved.
LegalTrademarks: Trademark © Uber Technologies, Inc.
OriginalFilename: eiP5ufeu
ProductName: ygUdFlSAtBOs
ProductVersion: 7,532,25,434
Translation: 0x081a 0x081a

Win32/GenKryptik.GJUU also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Cerbu.178539
MalwarebytesBackdoor.Agent
SangforTrojan.Win32.Save.a
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/GenKryptik.GJUU
APEXMalicious
CynetMalicious (score: 100)
KasperskyVHO:Backdoor.Win32.Convagent.gen
BitDefenderGen:Variant.Cerbu.178539
AvastCrypterX-gen [Trj]
F-SecureHeuristic.HEUR/AGEN.1311185
McAfee-GW-EditionBehavesLike.Win32.Generic.fc
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.533bfe54ef87d23a
GDataGen:Variant.Cerbu.178539
AviraHEUR/AGEN.1311185
MAXmalware (ai score=86)
ZoneAlarmVHO:Backdoor.Win32.Convagent.gen
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GoogleDetected
Cylanceunsafe
RisingTrojan.Generic@AI.81 (RDML:yRo0igoxKRmjRY9ohFCwQg)
IkarusTrojan.Win32.Crypt
FortinetMSIL/Agent.DFY!tr
AVGCrypterX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Win32/GenKryptik.GJUU?

Win32/GenKryptik.GJUU removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment