Should I remove “Win32/Kryptik.DRSF”?

The Win32/Kryptik.DRSF is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.DRSF virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Polish
• Unconventionial language used in binary resources: Polish
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavior consistent with a dropper attempting to download the next stage.
• Attempts to modify proxy settings
• Mimics icon used for popular non-executable file format
• Anomalous binary characteristics

How to determine Win32/Kryptik.DRSF?

File Info:
name: B5E2F80830BF0DA374A7.mlw
path: /opt/CAPEv2/storage/binaries/f190b8012d0b33897ebacc7f4fa6cb464f2106987f573cf7adc8329b73130b1f
crc32: 67BCF280
md5: b5e2f80830bf0da374a77e9d1d717da5
sha1: 91f204742e847d63a94eb77003b5b3685787821a
sha256: f190b8012d0b33897ebacc7f4fa6cb464f2106987f573cf7adc8329b73130b1f
sha512: bb77194e7968d51b20750c320c529e184eb445ee07e5c8bfb2c4d75188100feb8319814536ad976bda03b5529b3558c8b30e3ee6220cad98315de5ee0866b75a
ssdeep: 1536:ooQMr1VPQcU4lTmPV/61xonpHmk+VFIV7k7kwy8N6xiJ:71r1BVlqPN61xodIFMA74xi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13F63192262D48071E5611F3CD075A6D2066BBE217EF4F08F6E8835EC5F736C06AB9726
sha3_384: 50602e7dfb73b61f59b9aec92ba8ad6c58ba668b9fa7ed8415cb9f5c8043f1f505c2e35932d800c478997070c0a2d3c0
ep_bytes: e83d280000e9011e0000558bec518b45
timestamp: 2015-01-27 13:49:55

Version Info:
CompanyName: Aloseeye
FileDescription: Closeeye
FileVersion: 1.1.2.17
InternalName: AloseeyeInternal
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: 
ProductName: Aloseeye
ProductVersion: 2.1
Translation: 0x0415 0x04e5

Win32/Kryptik.DRSF also known as:

How to remove Win32/Kryptik.DRSF?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.