Win32/Kryptik.AWXN malicious file

The Win32/Kryptik.AWXN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.AWXN virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Attempts to connect to a dead IP:Port (22 unique times)
• Dynamic (imported) function loading detected
• Starts servers listening on 127.0.0.1:0
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Steals private information from local Internet browsers
• Exhibits behavior characteristic of Kelihos malware
• Installs itself for autorun at Windows startup
• Collects information about installed applications
• Attempts to access Bitcoin/ALTCoin wallets
• Harvests credentials from local FTP client softwares
• Installs WinPCAP

How to determine Win32/Kryptik.AWXN?

File Info:
name: CE17FA87455BD7480690.mlw
path: /opt/CAPEv2/storage/binaries/5d161c3bf602ec0754e876d53d3a3787fb5553d44ab31ac78fe499faf12d3884
crc32: 3E42B6C5
md5: ce17fa87455bd7480690aa70fd57dbaf
sha1: f135d4010208227fbb59eebac44762767e68aad0
sha256: 5d161c3bf602ec0754e876d53d3a3787fb5553d44ab31ac78fe499faf12d3884
sha512: d72298a8d94f6fe378795de88299bbb7e4da819ac8f333a00ede5a23d04d96353d607718c8d39f5301045d4b40a608ee22d543ec91126be54184f588d4a1b641
ssdeep: 12288:+hX8aHOMr0X+RHz5ZCrRNSnZ8KJkfKdHYY0IaB0RSodaFx4d1hWibVXTAe9If:RaHIazjvnZ9CCZTBaAo6d1dRq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14D0523A6610EC991C20BD97C19970738AF3F2DE07A1581FEB6A8F5815D7BBD07D32068
sha3_384: 717b0f055f63c9fcd472a2b70adbee8eecd693c1d8f0314fb00338895e70f45e5bc1a71bd10e0aa2e46b7b6b0fe17386
ep_bytes: 2bf68bce81ce4038400083ee6d8b46ff
timestamp: 2013-01-23 18:06:36

Version Info:
0: [No Data]

Win32/Kryptik.AWXN also known as:

How to remove Win32/Kryptik.AWXN?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.