Win32/Kryptik.CNPE information

The Win32/Kryptik.CNPE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.CNPE virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Unconventionial language used in binary resources: Greek
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics
• Binary compilation timestomping detected

How to determine Win32/Kryptik.CNPE?

File Info:
name: 05C3E761445BE2801CD2.mlw
path: /opt/CAPEv2/storage/binaries/1d209cf009a38d71fac85f21d4fe1bf90fb8dae20e0987e5e3836ebcb48306a4
crc32: 7ADECB35
md5: 05c3e761445be2801cd2101a310fdd8f
sha1: 01843cc012f9419dad7045f2c66814aa32216e06
sha256: 1d209cf009a38d71fac85f21d4fe1bf90fb8dae20e0987e5e3836ebcb48306a4
sha512: b1beb2559a35d3552f684d81a69e1f9f064582393cb609f3708dad66b34f62d9f555ea31b3b1bc30b5ad9784875d83a5bc03a9460ec8a536864171077edd3f18
ssdeep: 384:cKUDthWY/ANpYL3QVvSwBRcDgYCNXGQ4cyZw:SWTNyMhhvcgNWQ4jZw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T108B284258FED7CE6E2A656385DB963056934F909A3E049CF4F8015EF1C325D3B871B0A
sha3_384: 5cabba9a5cc4099c7e7c080bf7c80a7a58c650f8110b91669bb794df7fcf29da94fa34e9c632ed5389548a550fdc605f
ep_bytes: 558bec83ec4456ff15083040008bf08a
timestamp: 2065-06-19 23:03:10

Version Info:
CompanyName: Dangdrago
FileDescription: Dangdrago Ind.
FileVersion: Version 1.2
InternalName: Dangdrago
LegalCopyright: Copyright by Dangdrago Ind.
OriginalFilename: Dangdrago
Translation: 0x0407 0x04b1

Win32/Kryptik.CNPE also known as:

How to remove Win32/Kryptik.CNPE?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.