Malware

Win32/Kryptik.AKGW removal instruction

Malware Removal

The Win32/Kryptik.AKGW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Win32/Kryptik.AKGW virus can do?

  • Executable code extraction
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • Mimics the system’s user agent string for its own requests
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Starts servers listening on 0.0.0.0:18958, :0
  • Expresses interest in specific running processes
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Performs some HTTP requests
  • Code injection with CreateRemoteThread in a remote process
  • Tries to unhook or modify Windows functions monitored by Cuckoo
  • Steals private information from local Internet browsers
  • A system process is generating network traffic likely as a result of process injection
  • Installs itself for autorun at Windows startup
  • Creates Zeus (Banking Trojan) mutexes
  • Zeus P2P (Banking Trojan)
  • Attempts to modify proxy settings
  • Attempts to modify browser security settings
  • Harvests credentials from local FTP client softwares
  • Creates a slightly modified copy of itself
  • Collects information to fingerprint the system
  • Anomalous binary characteristics
  • Clears web history

Related domains:

z.whorecord.xyz
a.tomx.xyz
bsxszzqqlpbstkom.info
ocsp.pki.goog
crl.pki.goog
crls.pki.goog
jwgsmtvijqusgpvd.biz

How to determine Win32/Kryptik.AKGW?


File Info:

crc32: 1ED461E0
md5: 444db4fb6387135241d942f55708df83
name: 444DB4FB6387135241D942F55708DF83.mlw
sha1: 6be0cbea2b1d49a5fa12aa237ef59e7760937b15
sha256: cd8866eb2cbece6ba962759199a5b456e4e00334d8c46a91160cb4e20f988438
sha512: 87c1a861bf9a3d4e6d38a4947c90178199be3b0f346acc68f56bbead2ac6227cabfb4a3698bc406d7e99a173a00618f8e493a0cb7bfd4d999036c8ed565a7574
ssdeep: 3072:F5+GMViEUkxeeIJMpNG3GS9EQS1S2LC2ZSDAd8hG8bvcoO+WIppywFSbo2Y8w:fMVrUdjJMpNqGS9KS2LC2U9oGcZIppyy
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Win32/Kryptik.AKGW also known as:

BkavW32.AIDetect.malware2
K7AntiVirusRiskware ( 0040eff71 )
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Panda.565
CynetMalicious (score: 100)
CAT-QuickHealTrojan.Zbot.mue
ALYacGen:Heur.Conjar.8
CylanceUnsafe
ZillyaTrojan.Genome.Win32.103326
SangforTrojan.Win32.Conjar.8
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojan:Win32/Bulta.e8ab7828
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.b63871
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.AKGW
APEXMalicious
AvastWin32:Malware-gen
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Heur.Conjar.8
NANO-AntivirusTrojan.Win32.Zbot.cgmbu
ViRobotTrojan.Win32.Z.Conjar.161028
MicroWorld-eScanGen:Heur.Conjar.8
TencentWin32.Trojan.Generic.Pavt
Ad-AwareGen:Heur.Conjar.8
SophosMal/Generic-R + Mal/FakeAV-BW
ComodoMalware@#5lin7ff7hgjk
VIPRETrojan-Spy.Win32.Zbot.yy (v)
TrendMicroPE_LICAT.SM-O
McAfee-GW-EditionBehavesLike.Win32.ZBot.ch
FireEyeGeneric.mg.444db4fb63871352
EmsisoftGen:Heur.Conjar.8 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Generic.ekxbr
WebrootW32.Infostealer.Zeus
AviraTR/Crypt.XPACK.Gen3
eGambitGeneric.Malware
Antiy-AVLTrojan/Generic.ASMalwS.3CCEC8
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftTrojan:Win32/Zbot.SIBE15!MTB
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataGen:Heur.Conjar.8
AhnLab-V3Spyware/Win32.Zbot.C4558
McAfeePWS-Zbot.gen.db
MAXmalware (ai score=100)
VBA32Malware-Cryptor.MTA
PandaGeneric Malware
TrendMicro-HouseCallPE_LICAT.SM-O
RisingTrojan.Generic@ML.91 (RDML:A7yowZQNuOSjL3CMkF85FQ)
YandexTrojan.GenAsa!14P6HQWjp+M
IkarusTrojan.Win32.Crypt
MaxSecureTrojan.Malware.1809805.susgen
FortinetW32/FakeAv.AKGW!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml

How to remove Win32/Kryptik.AKGW?

Win32/Kryptik.AKGW removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment