Categories: Malware

Win32/Kryptik.CNRE removal tips

The Win32/Kryptik.CNRE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.CNRE virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Anomalous file deletion behavior detected (10+)
Dynamic (imported) function loading detected
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Greek
Authenticode signature is invalid
Anomalous binary characteristics
Binary compilation timestomping detected

How to determine Win32/Kryptik.CNRE?


File Info:
name: 1CC70D5ACF0B4FFB55BD.mlwpath: /opt/CAPEv2/storage/binaries/515524f71cc847da64aef5d74460785856a136e684da00d374ef557f3c1aa9aacrc32: 76DA9D6Fmd5: 1cc70d5acf0b4ffb55bd8a5632087ea7sha1: ada8f3416f803f50df0e4d24013f60ee7a2d1d7fsha256: 515524f71cc847da64aef5d74460785856a136e684da00d374ef557f3c1aa9aasha512: 8df7299d1bd29f8228dc0802524a284e8625cb4727529a54fff3c577b75924b2344c8a2d7a7f44c369bef40553d17525e9080eca010e21895f2e775b9f271d55ssdeep: 384:c/5Bp+VjrIl5FDCurr+8/6QsY1tgCNXGQqPl:u5BerY3Wu2e7tRNWQstype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1E962286AC7F444B2F3F3967618BE27116879FA946B748ECF0180299B0922BC1DD3175Esha3_384: d5aea478dc75aa93a3fc71bc1f7265f44c771610adbba7c1a977b160452ce1e3c3897b436364f41c1b9ebc36bdf82283ep_bytes: 558bec6aff681033400068402a400064timestamp: 2065-06-20 06:29:25
Version Info:
CompanyName: DangdragoFileDescription: Dangdrago Ind.FileVersion: Version 1.2InternalName: DangdragoLegalCopyright: Copyright by Dangdrago Ind.OriginalFilename: DangdragoTranslation: 0x0407 0x04b1

Win32/Kryptik.CNRE also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Ppatre.Gen.1
FireEye	Generic.mg.1cc70d5acf0b4ffb
CAT-QuickHeal	Downloader.Upatre.19949
McAfee	Downloader-FSH
Zillya	Downloader.Upatre.Win32.73
K7AntiVirus	Trojan ( 0055dd191 )
K7GW	Trojan ( 0055dd191 )
Cybereason	malicious.acf0b4
BitDefenderTheta	Gen:NN.ZexaF.34182.am1@aKOVnpaO
VirIT	Trojan.Win32.Generic.AUQD
Cyren	W32/A-b3be8561!Eldorado
Symantec	Downloader.Upatre!gen5
ESET-NOD32	a variant of Win32/Kryptik.CNRE
Baidu	Win32.Trojan-Downloader.Waski.a
TrendMicro-HouseCall	TROJ_UPATRE.SM37
ClamAV	Win.Trojan.Upatre-3458
Kaspersky	Trojan-Downloader.Win32.Upatre.dmd
BitDefender	Trojan.Ppatre.Gen.1
NANO-Antivirus	Trojan.Win32.Upatre.dgwnzg
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
APEX	Malicious
Tencent	Trojan-Downloader.Win32.Waski.16000151
Emsisoft	Trojan.Ppatre.Gen.1 (B)
Comodo	TrojWare.Win32.Kryptik.CNYX@5gkfaq
DrWeb	Trojan.Upatre.100
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_UPATRE.SM37
McAfee-GW-Edition	Downloader-FSH!1CC70D5ACF0B
Sophos	ML/PE-A + Mal/Zbot-QL
Ikarus	Trojan-Downloader.Win32.Upatre
Jiangmin	TrojanDownloader.Upatre.ek
Avira	TR/ATRAPS.A.1944
Antiy-AVL	Trojan/Generic.ASMalwS.C7AFAA
Microsoft	Trojan:Win32/PWSZbot.GSB!MTB
GData	Trojan.Ppatre.Gen.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Upatre.R121722
VBA32	TrojanDownloader.Upatre
ALYac	Trojan.Ppatre.Gen.1
MAX	malware (ai score=84)
Malwarebytes	Malware.AI.3671299068
Avast	Win32:Downloader-WIH [Trj]
Rising	Downloader.Upatre!8.B5 (RDMK:cmRtazpt5CcK7dTYWSw8Vcr6k5Uk)
Yandex	Trojan.Kryptik!jOBYoKYqXDY
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_92%
Fortinet	W32/Waski.A!tr
AVG	Win32:Downloader-WIH [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (D)