Win32/Kryptik.EOKW (file analysis)

The Win32/Kryptik.EOKW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.EOKW virus can do?

Executable code extraction
Compression (or decompression)
Creates RWX memory
The binary likely contains encrypted or compressed data.
Behavior consistent with a dropper attempting to download the next stage.
Exhibits behavior characteristic of Locky ransomware
Anomalous binary characteristics

Related domains:

wpewjgocy.uk

kfbgrcrlebcs.ru

fawxdwaibul.ru

spwocfkxcbwkvg.uk

gftbyj.ru

xumcu.us

How to determine Win32/Kryptik.EOKW?


File Info:
crc32: 6E67A517
md5: 1a6210b2edcba6875dc2ae91aeeade78
name: 1A6210B2EDCBA6875DC2AE91AEEADE78.mlw
sha1: ab0a8659882d2d36a114bc7ad3b749e3c44d279d
sha256: 976059c030c256db4a22d0fcbf2372cc3320877025154b5efeb3f7a1a26b1774
sha512: 380bf180e947c0e1bd109a480cba6c114b3fc3c5f6534f957a166379e77a0ce3fa241ae807483bec9b41fbe8d25c35320264f298461efd0b0654f272ae1fa1bd
ssdeep: 3072:vWBKecS5ns/xGmFVk0gQBlH7o+uK0IRU5cR8oa3zeBzd3An1YgCQSPH96PHNrD5:vWwej5s/x1k8B1o5QRU5V3zeBzJAn3C
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 Info-ZIP 1997 - 2008
InternalName: !2z
FileVersion: 5.2
CompanyName: Info-ZIP
ProductName: Zip
ProductVersion: 5.5
FileDescription: Info-2Ij 2ij for 1inme 2qnjole
OriginalFilename: m1c2.dll
Translation: 0x0409 0x04e4

Win32/Kryptik.EOKW also known as:

Bkav	W32.RenegilS.Trojan
K7AntiVirus	Trojan ( 0055374d1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader19.28288
ClamAV	Win.Ransomware.Locky-7
CAT-QuickHeal	Ransom.Locky.S5
McAfee	Ransomware-Locky
Cylance	Unsafe
Zillya	Trojan.PCryptGen.Win32.1
Sangfor	Trojan.Win32.Generic.ky
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/Locky.266f587d
K7GW	Trojan ( 0055374d1 )
Cybereason	malicious.2edcba
Cyren	W32/Locky.C.gen!Eldorado
Symantec	Ransom.TeslaCrypt
ESET-NOD32	a variant of Win32/Kryptik.EOKW
APEX	Malicious
Avast	Win32:Locky-E [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Heur.Locky.1
NANO-Antivirus	Trojan.Win32.Dwn.eajeyj
ViRobot	Trojan.Win32.Locky.Gen.A
SUPERAntiSpyware	Trojan.Agent/Gen-Locky
MicroWorld-eScan	Gen:Heur.Locky.1
Tencent	Trojan.Win32.Kryptik.eokw
Ad-Aware	Gen:Heur.Locky.1
Sophos	Mal/Generic-R + Troj/Agent-AQIR
Comodo	TrojWare.Win32.Yakes.EQX@6b1qke
BitDefenderTheta	Gen:NN.ZexaF.34686.ku0@aWINMGci
VIPRE	Trojan.Win32.Locky.me (v)
TrendMicro	Ransom_LOCKY.SM0
McAfee-GW-Edition	BehavesLike.Win32.Locky.ch
FireEye	Generic.mg.1a6210b2edcba687
Emsisoft	Trojan-Ransom.Win32.Locky (A)
SentinelOne	Static AI – Malicious PE
Webroot	Trojan.Gen
Avira	HEUR/AGEN.1102639
eGambit	Unsafe.AI_Score_98%
Kingsoft	Win32.Troj.GenericKD.v.(kcloud)
Microsoft	Ransom:Win32/Locky.A
AegisLab	Trojan.Win32.Locky.j!c
GData	Win32.Trojan-Ransom.Locky.K
AhnLab-V3	Trojan/Win32.Locky.R174806
Acronis	suspicious
VBA32	SScope.Malware-Cryptor.01499
MAX	malware (ai score=100)
Malwarebytes	Ransom.Locky
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Ransom_LOCKY.SM0
Rising	Ransom.Locky!1.B656 (CLOUD)
Ikarus	Trojan-Ransom.Locky
Fortinet	W32/Locky.C!tr
AVG	Win32:Locky-E [Trj]
Paloalto	generic.ml

How to remove Win32/Kryptik.EOKW?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.EOKW (file analysis)