Categories: Malware

Win32/Kryptik.ARUZ removal guide

The Win32/Kryptik.ARUZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.ARUZ virus can do?

Behavioural detection: Executable code extraction – unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Attempts to connect to a dead IP:Port (21 unique times)
Dynamic (imported) function loading detected
Starts servers listening on 127.0.0.1:0
Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Exhibits behavior characteristic of Kelihos malware
Installs itself for autorun at Windows startup
Collects information about installed applications
Attempts to access Bitcoin/ALTCoin wallets
Harvests credentials from local FTP client softwares
Installs WinPCAP
Anomalous binary characteristics

How to determine Win32/Kryptik.ARUZ?


File Info:
name: 222E1625EF6A77E3078D.mlwpath: /opt/CAPEv2/storage/binaries/1f85e74e7a1de2cbefa41eed9bae5fb4e1af7d0c3ceed8150a93965107780b3bcrc32: 59902080md5: 222e1625ef6a77e3078d7dc1341c4af0sha1: 8fd1930ccff629b3038d4075d874345b5308489bsha256: 1f85e74e7a1de2cbefa41eed9bae5fb4e1af7d0c3ceed8150a93965107780b3bsha512: 6144c3f3c0efb1631aba4f6404b468c9ba6e08251e2de332fe2c5c396ae6546c84f33c5814eefbe088a152b7bdd2aa13e16b5550ed7762523108f2662795b27fssdeep: 12288:a9Hp5t8fU4cwrgzCM+gjvt7En2mI1JqNaCVz+0FqvnliSleIwV8q56ckICv6y5Mx:gBp4jngjl7E7ICVz+6qvliSlRwVh5sI9type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1ADF42321C46710F2DE5F213024266A336B8EFD426B66739B3FE5FCE81F366E56456840sha3_384: 00d7473a32a0658f5f1be18be81f6609a754973eaa3db9c731ffc68c6ba44fb4ec52f887a7ba5cb2bffbe38e35102f7bep_bytes: 68004040005f8d35f02f40006a1d59f3timestamp: 2012-08-31 23:11:12
Version Info:
0: [No Data]

Win32/Kryptik.ARUZ also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Generic.lmka
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.222e1625ef6a77e3
CAT-QuickHeal	Trojan.Lethic.B
McAfee	BackDoor-FJW
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0040f2c01 )
Alibaba	Trojan:Win32/Starter.ali2000005
K7GW	Trojan ( 0040f2c01 )
Cybereason	malicious.5ef6a7
Baidu	Win32.Trojan.Kryptik.ur
VirIT	Trojan.Win32.Crypt_s.ADD
Cyren	W32/FakeAlert.WP.gen!Eldorado
Symantec	SecShieldFraud!gen10
ESET-NOD32	a variant of Win32/Kryptik.ARUZ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.VIZ.Gen.1
NANO-Antivirus	Trojan.Win32.Agent.dmfgzo
MicroWorld-eScan	Trojan.VIZ.Gen.1
Avast	Win32:Crypt-OSU [Trj]
Tencent	Win32.Init.QQRob.myo
Emsisoft	Trojan.VIZ.Gen.1 (B)
Comodo	TrojWare.Win32.Kryptik.ARQC@4t65ce
DrWeb	Trojan.Packed.23721
VIPRE	VirTool.Win32.Obfuscator.da!j (v)
TrendMicro	WORM_KELIHOS.SMB
McAfee-GW-Edition	BehavesLike.Win32.VirRansom.bc
Sophos	ML/PE-A + Mal/Zbot-KR
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Tepfer.Gen
MaxSecure	Trojan.Malware.300983.susgen
Avira	TR/Winwebsec.669874
Antiy-AVL	Trojan/Generic.ASMalwS.11FD983
Kingsoft	Win32.Troj.Agent.k.(kcloud)
Gridinsoft	Ransom.Win32.Zbot.sa
Microsoft	Backdoor:Win32/Kelihos.F
SUPERAntiSpyware	Trojan.Agent/Gen-RogueRel
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.VIZ.Gen.1
AhnLab-V3	Trojan/Win32.Tepfer.R48343
BitDefenderTheta	Gen:NN.ZexaF.34182.UqW@aWBv2wo
ALYac	Trojan.VIZ.Gen.1
MAX	malware (ai score=89)
VBA32	Trojan.FakeAV.01657
Malwarebytes	Malware.AI.2508706408
TrendMicro-HouseCall	WORM_KELIHOS.SMB
Rising	Backdoor.Kelihos!8.543 (CLOUD)
Yandex	Trojan.GenAsa!uOX5oYgwUp4
Ikarus	Trojan-PSW.Win32.Tepfer
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Kryptik.X!tr
AVG	Win32:Crypt-OSU [Trj]
Panda	Trj/Tepfer.B
CrowdStrike	win/malicious_confidence_100% (D)