Categories: Malware

Win32/Kryptik.DYXI removal instruction

The Win32/Kryptik.DYXI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.DYXI virus can do?

Behavioural detection: Executable code extraction – unpacking
Dynamic (imported) function loading detected
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Bulgarian
Authenticode signature is invalid
Attempts to identify installed AV products by registry key
Anomalous binary characteristics

How to determine Win32/Kryptik.DYXI?


File Info:
name: 15F50883EFCD797AF0FA.mlwpath: /opt/CAPEv2/storage/binaries/0379c39382992aa91b0736acaaa2bcd92a76cc1c682043557db2aaa9df256652crc32: E352E0CEmd5: 15f50883efcd797af0fae02d29c763c9sha1: 08f046d4617d3632aefe6bf3b4eafcddb35abcb1sha256: 0379c39382992aa91b0736acaaa2bcd92a76cc1c682043557db2aaa9df256652sha512: 33b73eebace7f1422d670372dd8421860b7f262f0deedb644f552ebe5f476339339aedafae4691cdaa7f1333011bd3239306f4a28956a4f75038892142f2bda5ssdeep: 3072:ORLYPMT565+ZXO2FiasDJR0bwZLsOEAfA:SaMTEX2FznwZLsOEtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T149D35C313834B45FEA77A8B248D25C81964CC678A8604E5B7FCFA49F718D4B7098A1F7sha3_384: 272a262caf84016ce0e8d7c09d752ec9e1fb99cec197ce819bf6aeb6460282ea62f9ecf112db95a770bd4ec4cd4c1061ep_bytes: 558bec538b5d08568b750c68c7dc4000timestamp: 2004-07-27 22:38:30
Version Info:
CompanyName: LITE-ON TECHNOLOGY CORP.FileDescription: UnemotionalFileVersion: 32, 178, 119, 251InternalName: SymbolicallyLegalCopyright: Watery (C) 2017OriginalFilename: Appertained.exeProductName: Bedridden Supplemented

Win32/Kryptik.DYXI also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.2069
FireEye	Generic.mg.15f50883efcd797a
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0055dd191 )
K7GW	Trojan ( 0055dd191 )
BitDefenderTheta	Gen:NN.ZexaF.34806.iq0@aCYvfUoG
Symantec	Packed.Generic.497
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.DYXI
Kaspersky	VHO:Trojan.Win32.Yakes.gen
NANO-Antivirus	Trojan.Win32.Yakes.dyefrx
Avast	Win32:TeslaCrypt-Q [Trj]
Sophos	ML/PE-A + Troj/Ransom-BJY
Zillya	Trojan.Yakes.Win32.41932
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.Yakes.ezs
Avira	HEUR/AGEN.1219153
Antiy-AVL	Trojan/Generic.ASMalwS.24F
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
VBA32	BScope.TrojanDownloader.Talalpek
APEX	Malicious
Yandex	Trojan.Yakes!He63kQ45pPA
Fortinet	W32/Papras.EH!tr
AVG	Win32:TeslaCrypt-Q [Trj]
CrowdStrike	win/malicious_confidence_100% (W)