About “Win32/Kryptik.BQGE” infection

The Win32/Kryptik.BQGE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.BQGE virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• A file with an unusual extension was attempted to be loaded as a DLL.
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Creates a copy of itself

How to determine Win32/Kryptik.BQGE?

File Info:
name: 9DE36C42C283B078D7D8.mlw
path: /opt/CAPEv2/storage/binaries/cff5be1d64de544b5717d4bf7b6dc97d0164dc2f32c40aba1e01185e40b6d68f
crc32: 45E769E9
md5: 9de36c42c283b078d7d8690188e9c38d
sha1: 0972550d2792e1d9a09115058e9e59289014137e
sha256: cff5be1d64de544b5717d4bf7b6dc97d0164dc2f32c40aba1e01185e40b6d68f
sha512: 89e005ff699a37ecf8280ddccd680632b81079aeabdf962648d7c9054a3bfb83949e09f620271069e32e9a890afc528db5153d10855485e4e5415d010140a898
ssdeep: 1536:Hr156a9MSEktad8ufZUCm2pzkxQGXAjWBIj5ACeAGZaqooxhQAusPW:Hr2a6otA8ufZ42W1AC9CIxo2hQAS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FA93E1807252D566F6A6DF312803CCA3754127F9CFD57FA1A0A851507F704EA28EAA27
sha3_384: df2d43e92f5eb127ead212051c82fb98110dc71eb21a618d34660d6b447b7f6763917163723b38ed383bf42e2dfe005b
ep_bytes: 558bec6aff683c13410068822b400064
timestamp: 2008-11-17 06:47:38

Version Info:
Comments: 
CompanyName: Trend Micro Inc.
FileDescription: Trend Micro AntiVirus Plus AntiSpyware
FileVersion: 17.50.0.1366
InternalName: 7zsfx.exe
LegalCopyright: Copyright (C) 1995-2012 Trend Micro Incorporated. All rights reserved.
LegalTrademarks: Copyright (C) Trend Micro Inc.
OriginalFilename: 7zsfx.exe
PrivateBuild: Build 1366 - 7/29/2009
ProductName: Trend Micro Internet Security
ProductVersion: 17.50
SpecialBuild: 1366
Translation: 0x0409 0x04e4

Win32/Kryptik.BQGE also known as:

How to remove Win32/Kryptik.BQGE?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.