About “Win32/Kryptik.CKZM” infection

The Win32/Kryptik.CKZM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.CKZM virus can do?

• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Romanian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Created a process from a suspicious location
• Anomalous binary characteristics

How to determine Win32/Kryptik.CKZM?

File Info:
name: 1F02A8F04D4BD64670DD.mlw
path: /opt/CAPEv2/storage/binaries/a67dedfad50f6434b574d2bb3d757427af6460511451d1c3086ccf9048789dd0
crc32: 8E2A0B5C
md5: 1f02a8f04d4bd64670ddd0e1e51634ff
sha1: 74ec135084c9c8212ac98dc124969cc72f74649c
sha256: a67dedfad50f6434b574d2bb3d757427af6460511451d1c3086ccf9048789dd0
sha512: 2c0ef2de4d90bddb737dbd1014a91f9024614d459134051ab4582060332e1de69c62d5ae7e266b50da6931b411861d308f977b170e75ee8f03a7724268ce67cb
ssdeep: 384:a6skjkpLIu4nesy68Qkny+do4kfaqCKLe91aXnL3wU:agwpLIesy68Q3+dotaqCKLeDMT
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T105C2D5384A880E72F134CE7944F995A31176FE656B3A07CB956034391533EF2BB7E488
sha3_384: 2080092245aa0bb66cb5fc3cf44e5b8257982ba04c1023098bf74b502c26bb5a8c1d8bdadf69cf7c9d17114518a405f1
ep_bytes: 53b8ffff0010e80f0400005bc3cccccc
timestamp: 1970-10-02 15:51:21

Version Info:
0: [No Data]

Win32/Kryptik.CKZM also known as:

How to remove Win32/Kryptik.CKZM?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.