The Win32/Kryptik.ERB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.
Gridinsoft Anti-Malware
Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
What Win32/Kryptik.ERB virus can do?
- Behavioural detection: Executable code extraction – unpacking
- Yara rule detections observed from a process memory dump/dropped files/CAPE
- Creates RWX memory
- Possible date expiration check, exits too soon after checking local time
- Dynamic (imported) function loading detected
- Reads data out of its own binary image
- CAPE extracted potentially suspicious content
- Unconventionial language used in binary resources: Russian
- Authenticode signature is invalid
- Anomalous binary characteristics
How to determine Win32/Kryptik.ERB?
File Info:
name: 820BAB8512636C943666.mlwpath: /opt/CAPEv2/storage/binaries/52721cb47809b07d80eb27de719334b5acbabf727f1fb9f428e519afc68cda6bcrc32: 258238D6md5: 820bab8512636c94366696c816144fa9sha1: 144bf5fe3c09cfe33941bd92a53912580845a8dcsha256: 52721cb47809b07d80eb27de719334b5acbabf727f1fb9f428e519afc68cda6bsha512: 9520d41f84dc5e9cf5e6bdc5804db7fbc3c7c8869bf1ab4fb3ed2455135e6f4c117bb10e1a0ca9771d153ea999ea31d5da47b3e5595b57579a8882f03ef99db7ssdeep: 768:sgnwTojbNK1VYL7YynFU5CEuNca1DiEDOg3E4gW4OaYU5SGLEdqK0tAcut:sVoXnF+Aj1Py4E4g+fU51L0CtAcutype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C1C3F16B3CA660B2C48B457688D75939EE33FF30B7F44E44C6809676AB74787F809819sha3_384: ab934afcb13462738d22ea6df6e7a4ab05f64ea43bb9615fe86466002817a3165868b7bfdac7109985ea0398b35745d5ep_bytes: 0f95c4660fb6f30f91c66689d064a130timestamp: 2005-06-02 14:55:42Version Info:
CompanyName: †SOFTWINꊣ쉜⫽켦ӌ⮠ꆜ훞逡uda79蠍昃룦Ꮠ樦勹㷉봔묈㲭㶛⏓熄ud841幮떾︅▿廣织먡烚ﳷ꼢慏뷹˞⁐ꑗ艢聜ꐷude3cඁ잸udaac⤼㡆᱔䐖㱣犃㲻렝ᶲቭ뵗Ⅹꏑﴝ㞥荳쭒鴩㠉敠펂≍ᐞ燸ビḢ碬纟䳉握uda21푧ᶂ䅆꾔퀮胅ѩ瑯췑熫췀螏敨࣎먣현滛䤐因兛駮쳧快㡼╘⥐㔓톖㬯頶䂍㍡꒿憢❘畊釮㍳ꌂ勸㸲ᕀ翚ꍶ鷂漁褰鞗ㅡ濮⟩䘉鰃ཬ퓈튿ꁩ镄肀馯䢝ⅈ읇udf7d凪탘毯螙ꂘҴ鼔㸁䥛梾먊暇鶨䶊≂ﰪud99aῨ핢⎶멇낷耕撼嫔砾連磮쐮면眈ꠥ舟끜䏇㳗勪귗钗宖㊷兾角䯷製㬒挤udcae蕇udf97뻯ᅴ⊇졜쿀㦃杩菤䱍谕㡯韛깘⚿毂鶙ᝎ栯觌䵰곇握ွ㭕ោ麏祕udafa굔udf67乹䵼ꏓᮿ謍蛤辺Ქ䀟肴㺶㹏ᱶ觛躷udb56䞝顋ꓱ緧郷俧꽂ጤ籵ᄓ酯㣔䅍㦃㳶儘걛↬㿚ὐ뢜掩ᇉ㏨炅㼼浸敶獲潩㵮ㄢ〮•湥潣楤杮∽呕ⵆ∸猠慴摮污湯㵥礢獥㼢ാ㰊獡敳扭祬砠汭獮∽牵㩮捳敨慭業牣獯景潣㩭獡ㅶ•慭楮敦瑳敖獲潩㵮ㄢ〮㸢†愼獳浥汢䥹敤瑮瑩൹ ††瘠牥楳湯∽⸱⸰⸰∰†††牰捯獥潳䅲捲楨整瑣牵㵥堢㘸ഢ ††渠浡㵥䴢物湡慤䴮物湡慤䴮物湡慤ഢ ††琠灹㵥眢湩㈳ഢ ⼠ാ 㰠敤捳楲瑰潩㹮䥑㱐搯獥牣灩楴湯ാ 㰠牴獵䥴普浸湬㵳產湲猺档浥獡洭捩潲潳瑦挭浯愺浳瘮∲ാ †㰠敳畣楲祴ാ ††㰠敲畱獥整偤楲楶敬敧㹳††††爼煥敵瑳摥硅捥瑵潩䱮癥汥†††††敬敶㵬愢䥳癮歯牥ഢ ††††甠䅩捣獥㵳昢污敳⼢ാ ††㰠爯煥敵瑳摥牐癩汩来獥ാ †㰠猯捥牵瑩㹹†⼼牴獵䥴普㹯⼼獡敳扭祬>:
Win32/Kryptik.ERB also known as:
Bkav | W32.AIDetect.malware2 |
Lionic | Trojan.Win32.Generic.4!c |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Trojan.Brsecmon.1 |
FireEye | Generic.mg.820bab8512636c94 |
CAT-QuickHeal | TrojanPWS.Zbot.Y10 |
McAfee | Generic PWS.lv |
Cylance | Unsafe |
VIPRE | Trojan.Win32.Zbot.im (v) |
Sangfor | Trojan.Win32.Save.a |
K7AntiVirus | Trojan ( 0055dd191 ) |
Alibaba | Trojan:Win32/Kryptik.d0804421 |
K7GW | Trojan ( 0055dd191 ) |
Cybereason | malicious.512636 |
VirIT | Trojan.Win32.Generic.AYQQ |
Cyren | W32/FakeAlert.OG.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of Win32/Kryptik.ERB |
APEX | Malicious |
ClamAV | Win.Packed.Zbot-9890630-0 |
Kaspersky | HEUR:Trojan.Win32.Generic |
BitDefender | Trojan.Brsecmon.1 |
NANO-Antivirus | Virus.Win32.Gen.ccmw |
SUPERAntiSpyware | Trojan.Agent/Gen-Backdoor[Softwin] |
Avast | Win32:MalOb-CK [Cryp] |
Rising | Malware.Undefined!8.C (TFE:1:B7C9XwosInF) |
Ad-Aware | Trojan.Brsecmon.1 |
Emsisoft | Trojan.Brsecmon.1 (B) |
Comodo | Malware@#6cg6c3aaxczt |
DrWeb | Trojan.PWS.Panda.487 |
Zillya | Trojan.Zbot.Win32.97075 |
TrendMicro | TROJ_KRYPTK.SMM |
McAfee-GW-Edition | BehavesLike.Win32.Generic.ch |
Sophos | Mal/Generic-R + Mal/Zbot-IM |
Ikarus | Packer.Win32.Krap |
GData | Trojan.Brsecmon.1 |
Jiangmin | Trojan/Generic.bdmo |
Webroot | W32.Bumat.Gen |
Avira | TR/Crypt.XPACK.Gen2 |
Antiy-AVL | Trojan/Generic.ASMalwS.60F2DF |
Kingsoft | Win32.Troj.Zbot.ar.(kcloud) |
ZoneAlarm | HEUR:Trojan.Win32.Generic |
Microsoft | PWS:Win32/Zbot |
Cynet | Malicious (score: 100) |
Acronis | suspicious |
BitDefenderTheta | Gen:NN.ZexaF.34212.h00@aCRQGKfI |
ALYac | Trojan.Brsecmon.1 |
MAX | malware (ai score=100) |
VBA32 | Trojan.Zeus.EA.01000 |
TrendMicro-HouseCall | TROJ_KRYPTK.SMM |
Tencent | Malware.Win32.Gencirc.1169c173 |
Yandex | Trojan.GenAsa!kB9FcBgV20I |
SentinelOne | Static AI – Malicious PE |
Fortinet | W32/Kryptik.AJ!tr |
AVG | Win32:MalOb-CK [Cryp] |
Panda | Generic Malware |
CrowdStrike | win/malicious_confidence_100% (W) |
How to remove Win32/Kryptik.ERB?
- Download and install GridinSoft Anti-Malware.
- Open GridinSoft Anti-Malware and perform a “Standard scan“.
- “Move to quarantine” all items.
- Open “Tools” tab – Press “Reset Browser Settings“.
- Select proper browser and options – Click “Reset”.
- Restart your computer.
Leave a Comment