Win32/Kryptik.AZE (file analysis)

The Win32/Kryptik.AZE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Kryptik.AZE virus can do?

Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Win32/Kryptik.AZE?


File Info:
name: 3CCE624AEA127BC9C8C3.mlw
path: /opt/CAPEv2/storage/binaries/e1061230b29db4cea5b612e9075da279bf656e8eafe3c8fda6c575dd4b87d721
crc32: 55BAE5E3
md5: 3cce624aea127bc9c8c369598267bf85
sha1: 88fb39af03b8495b07f2a5ab9ac1d2a9192f8fdb
sha256: e1061230b29db4cea5b612e9075da279bf656e8eafe3c8fda6c575dd4b87d721
sha512: 5bc32d6550ab732e9356e4cbdd5c51437e25e57f70e115d639fcba795abf73cda73b3de4948e2b660b92534882237a91c73b19944e15b687d693fe31f75ab1f9
ssdeep: 768:4yNDNzH4gZB8UJBgJ+9Gz7XTHJYdQId1jy:vNzH4g7LkogSy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T198C29D51320402EEF36A0773384B85761772BC215AC386D699E07A667EA35F74F2B734
sha3_384: c97e996288df30c044bc40f40f229012ce54b1a14abd249078ab2dd4a023bb469e4308cfea111f229208fbbdeac713cd
ep_bytes: 558bec8bf94a43424703d62bd9eb793d
timestamp: 2005-02-04 01:33:45

Version Info:
CompanyName: vVP6agwWJnV
FileDescription: UB3cIR3IYSOBNXlD8d
FileVersion: vOfkIQVoiV4
InternalName: ppJtg3PjP64g
LegalCopyright: hsyuQllPbXh
OriginalFilename: bIO35IIhEljNibK1g6
ProductName: qjroohGBO6OtDPNc3I
ProductVersion: u5qJFjXa881NG
Translation: 0x0800 0x04b0

Win32/Kryptik.AZE also known as:

Lionic	Hacktool.Win32.Krap.kZ3u
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Packed.Hiloti.Gen.3
FireEye	Generic.mg.3cce624aea127bc9
McAfee	Downloader-CAQ
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005223351 )
Alibaba	VirTool:Win32/Obfuscator.d491e7ce
K7GW	Trojan ( 005223351 )
CrowdStrike	win/malicious_confidence_100% (D)
VirIT	Trojan.Win32.Packed.BAL
Cyren	W32/SuspPack.BH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.AZE
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Packed.Hiloti.Gen.3
NANO-Antivirus	Trojan.Win32.Crypted.dfawxk
Avast	Win32:Bredolab-AP [Trj]
Tencent	Win32.Trojan.Generic.Lnys
Ad-Aware	Trojan.Packed.Hiloti.Gen.3
Sophos	Mal/Generic-R + Mal/BredoPk-B
Comodo	TrojWare.Win32.Downloader.Fraudload.fv@4lnkgu
DrWeb	Trojan.Packed.687
VIPRE	LooksLike.Win32.Malware!B (v)
TrendMicro	TROJ_BREDLAB.SMJ
McAfee-GW-Edition	Downloader-CAQ
Emsisoft	Trojan.Packed.Hiloti.Gen.3 (B)
GData	Trojan.Packed.Hiloti.Gen.3
Jiangmin	TrojanDownloader.Genome.hpa
Webroot	W32.Malware.Downloader
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.2AC8EA9
Gridinsoft	Ransom.Win32.Zbot.sa
Microsoft	TrojanDownloader:Win32/Waledac.C
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Hiloti.Gen
Acronis	suspicious
BitDefenderTheta	AI:Packer.94770E4E1F
ALYac	Trojan.Packed.Hiloti.Gen.3
MAX	malware (ai score=100)
VBA32	Trojan.Zeus.EA.0999
TrendMicro-HouseCall	TROJ_BREDLAB.SMJ
Rising	Trojan.Win32.Waledac.fu (CLOUD)
Yandex	Trojan.DL.Waledac!FiwbJ8YsNRY
SentinelOne	Static AI – Malicious PE
AVG	Win32:Bredolab-AP [Trj]
Cybereason	malicious.aea127
Panda	Trj/Genetic.gen
MaxSecure	Trojan.Malware.7164915.susgen

How to remove Win32/Kryptik.AZE?

Win32/Kryptik.AZE removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X