Win32/Kryptik.AQUN removal instruction

The Win32/Kryptik.AQUN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.AQUN virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Attempts to connect to a dead IP:Port (22 unique times)
• Dynamic (imported) function loading detected
• Starts servers listening on 127.0.0.1:0
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Exhibits behavior characteristic of Kelihos malware
• Installs itself for autorun at Windows startup
• Collects information about installed applications
• Attempts to access Bitcoin/ALTCoin wallets
• Harvests credentials from local FTP client softwares
• Installs WinPCAP
• Anomalous binary characteristics

How to determine Win32/Kryptik.AQUN?

File Info:
name: EE47707ADA7AADC8A95A.mlw
path: /opt/CAPEv2/storage/binaries/ad2fc293426b0d50184a82b2fc41d4e34b964b4dc642fe06558803678c0e3161
crc32: B3BDC6D3
md5: ee47707ada7aadc8a95ae27371cafb85
sha1: a22a73ef62289b782c1fe7e90736c32b3ecbc91b
sha256: ad2fc293426b0d50184a82b2fc41d4e34b964b4dc642fe06558803678c0e3161
sha512: 0efcee6d4b89611cc6d1157efa3150eee3ebed5da74c590bd10dc77728d7ccb5b3040619390dfb24b33921fbb3f0ae61590a9cbce8b51f893233dc583d0e590a
ssdeep: 12288:8cRDuGjPidm77iyl/ky7jVFx/H6nnRZceUB+cCiKxMwy2G3xZe+Ilbs:ZLqdg7v7jVFBWnLcf2iKxMwy33fe+Ilo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17BF423B1C20486D9F650E7F6C4E25AC317D35FB1183A617C38AC3B8A4EFE947B499099
sha3_384: 39b6b995e764175fda21f64f936118a0e6cc0bbf10a4fb40fa06e3525ab6b38ec1b46cf4e1903b03805069716cd2f97e
ep_bytes: bf023040008d35dc1f40006a7459f3a4
timestamp: 2011-06-01 17:57:46

Version Info:
0: [No Data]

Win32/Kryptik.AQUN also known as:

How to remove Win32/Kryptik.AQUN?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.