Categories: Malware

How to remove “Win32/Kryptik.CTPM”?

The Win32/Kryptik.CTPM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.CTPM virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Arabic
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/Kryptik.CTPM?


File Info:
name: 047F720C4C2047656F84.mlwpath: /opt/CAPEv2/storage/binaries/f501e43831071101d8660e7aec279cfbc74d4e93fbd067d0f92b737e3b750dc2crc32: 4191CBF4md5: 047f720c4c2047656f842bb5ede45f86sha1: 0b6b18143c3897c139bee4e0f6b855a2041b75afsha256: f501e43831071101d8660e7aec279cfbc74d4e93fbd067d0f92b737e3b750dc2sha512: 00ba5e26052a9c4b0a9da67fb29b26a4391171319e6582b3ef93d9dc08bdd2da6fd9ffe1b0d142789f35a5dc7d6cc22457b8fa573ea919b04b147cd983b20024ssdeep: 12288:TLc/KNGOzG3Kfo++9Q08/yz2NyJ/2dBig32soRwpoMqUiSndxa:pt7j0tH52OktE84Sndxatype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T174B40283D743CBF2C2B939F9568F5E040A2425D401502F4793EEEDAAB2D6BB1751B6C8sha3_384: a5fc3eb8c04c96e7907c7c9a9c30418be14e84638a5432be748f6adaabfb0dce044678e158f2f41cfc49575b748ca03fep_bytes: 558bec81ecec000000b95aa70000898dtimestamp: 2012-03-24 11:06:32
Version Info:
ProductVersion: 11.31.2119.57992OriginalFilename: baess.exeCompanyName: Emnsiem CorporatuFileDescription: Emnsiem Visatl Studie 2020InternalName: baess.exeFileVersion: 11.31.2119.57992Translation: 0x0409 0x04b0

Win32/Kryptik.CTPM also known as:

Lionic	Trojan.Win32.Zbot.mf8l
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Panda.7719
MicroWorld-eScan	Gen:Heur.Variadic.A.110.1
FireEye	Generic.mg.047f720c4c204765
ALYac	Gen:Heur.Variadic.A.110.1
Cylance	Unsafe
Zillya	Trojan.Zbot.Win32.171643
Sangfor	Trojan.Win32.Kryptik.CTPM
K7AntiVirus	Trojan ( 0055dd191 )
K7GW	Trojan ( 0055dd191 )
Cybereason	malicious.c4c204
BitDefenderTheta	Gen:NN.ZexaF.34646.Fq1@aCf8tjEG
VirIT	Trojan.Win32.Banker.ALG
Cyren	W32/Zbot.VQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.CTPM
APEX	Malicious
TrendMicro-HouseCall	TSPY_ZBOT.SMAC
Paloalto	generic.ml
ClamAV	Win.Trojan.Zbot-61998
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Heur.Variadic.A.110.1
NANO-Antivirus	Trojan.Win32.MlwGen.dkqdsz
SUPERAntiSpyware	Trojan.Agent/Gen-Kazy
Avast	Win32:Agent-AUYE [Trj]
Tencent	Trojan.Win32.Zbot.c
Ad-Aware	Gen:Heur.Variadic.A.110.1
TACHYON	Trojan-Spy/W32.ZBot.508486
Emsisoft	Gen:Heur.Variadic.A.110.1 (B)
Comodo	TrojWare.Win32.Spy.Zbot.UDSF@5imov1
Baidu	Win32.Trojan.Kryptik.je
VIPRE	Gen:Heur.Variadic.A.110.1
TrendMicro	TSPY_ZBOT.SMAC
McAfee-GW-Edition	BehavesLike.Win32.Dropper.gh
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A + Troj/Zbot-JJI
Ikarus	Trojan-Spy.Zbot
Jiangmin	TrojanSpy.Zbot.ehea
Google	Detected
Avira	TR/Crypt.ZPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.31
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	PWS:Win32/Zbot
GData	Gen:Heur.Variadic.A.110.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Agent.R129010
McAfee	Trojan-FFFI!047F720C4C20
MAX	malware (ai score=88)
VBA32	BScope.TrojanPSW.Panda
Malwarebytes	Trojan.Zemot
Rising	Trojan.Crypto!8.364 (TFE:2:p9LxMZDhweV)
Yandex	Trojan.GenAsa!gWwDhtM/1ms
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Kryptik.CSQU!tr
AVG	Win32:Agent-AUYE [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)