Win32/Kryptik.EBLA malicious file

The Win32/Kryptik.EBLA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.EBLA virus can do?

Executable code extraction
Creates RWX memory
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Installs itself for autorun at Windows startup

Related domains:

smart.cloudnetwork.kz

static.apiinformation.kz

secure.jscontentmaker.kz

secure.jsc0nten1maker.com

static.apiinformationsec.com

mel.cloudcontentsmak.com

nicru.supermicrotransapi.ru

tel.jsapisettings.kz

js.securetopdevelopment.kz

noone.contentmakersbyakamai.ru

How to determine Win32/Kryptik.EBLA?


File Info:
crc32: E27433B4
md5: c17a65148047ee98de100da2fbe15646
name: C17A65148047EE98DE100DA2FBE15646.mlw
sha1: 512aabae0eadf6dba208c0e3b88915f89c0b2118
sha256: 6a06fd475a4c468243f50537725ea4472b224509e1be5bc9261e8716da59cb1f
sha512: 60ba9f2baf9bce08f341942390572fb828b8ef4ef7e2d330f0777e0d5449860b0a2cb4900336d8c2f4da0717128ac532fa77af7b6b14e68e6855b5fa193056e3
ssdeep: 12288:uXkUWaEQPPfTC4n+LpdhTbMsR9321Zhf4v7lH:uUUWuC4+ldd501ZG
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: Alt-N Technologies Copyright (c)
InternalName: Ancestors
FileVersion: 1.6.17.3
CompanyName: Alt-N Technologies
PrivateBuild: 1.6.17.3
LegalTrademarks: Alt-N Technologies Copyright (c)
Comments: Underground Trillion Fresher
ProductName: Ancestors
Languages: English
ProductVersion: 1.6.17.3
FileDescription: Underground Trillion Fresher
OriginalFilename: Ancestors.exe
Translation: 0x0409 0x04b0

Win32/Kryptik.EBLA also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0053458c1 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ransom.Scarab.43
Cylance	Unsafe
Zillya	Trojan.Foreign.Win32.57849
Sangfor	Trojan.Win32.GenericKD.40280355
Alibaba	Ransom:Win32/Foreign.b55e1318
K7GW	Trojan ( 0053458c1 )
Cybereason	malicious.48047e
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.EBLA
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Win32.Foreign.oaeg
BitDefender	Gen:Variant.Ransom.Scarab.43
NANO-Antivirus	Trojan.Win32.MalwareCrypter.fedqwu
MicroWorld-eScan	Gen:Variant.Ransom.Scarab.43
Tencent	Win32.Trojan.Foreign.Swko
Ad-Aware	Gen:Variant.Ransom.Scarab.43
Sophos	Mal/Generic-S
Comodo	Malware@#33tqhxifozcqi
BitDefenderTheta	Gen:NN.ZexaF.34686.CmKfa4fsqeni
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Generic.dva
FireEye	Generic.mg.c17a65148047ee98
Emsisoft	Gen:Variant.Ransom.Scarab.43 (B)
SentinelOne	Static AI – Suspicious PE
Webroot	W32.Trojan.Gen
Avira	TR/AD.MalwareCrypter.zxgss
Microsoft	Trojan:Win32/Occamy.C
AegisLab	Trojan.Win32.Foreign.j!c
GData	Gen:Variant.Ransom.Scarab.43
Acronis	suspicious
McAfee	Generic.dva
VBA32	BScope.TrojanRansom.Foreign
Panda	Trj/CI.A
Rising	Ransom.Foreign!8.292 (CLOUD)
Yandex	Trojan.Foreign!tavU5bVaLzw
Ikarus	Trojan.Win32.Krypt
Fortinet	W32/GenKryptik.CKGB!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Win32/Kryptik.EBLA?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.EBLA malicious file