Malware

Should I remove “Win32/Kryptik.ERB”?

Malware Removal

The Win32/Kryptik.ERB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Kryptik.ERB virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Win32/Kryptik.ERB?


File Info:

name: 820BAB8512636C943666.mlw
path: /opt/CAPEv2/storage/binaries/52721cb47809b07d80eb27de719334b5acbabf727f1fb9f428e519afc68cda6b
crc32: 258238D6
md5: 820bab8512636c94366696c816144fa9
sha1: 144bf5fe3c09cfe33941bd92a53912580845a8dc
sha256: 52721cb47809b07d80eb27de719334b5acbabf727f1fb9f428e519afc68cda6b
sha512: 9520d41f84dc5e9cf5e6bdc5804db7fbc3c7c8869bf1ab4fb3ed2455135e6f4c117bb10e1a0ca9771d153ea999ea31d5da47b3e5595b57579a8882f03ef99db7
ssdeep: 768:sgnwTojbNK1VYL7YynFU5CEuNca1DiEDOg3E4gW4OaYU5SGLEdqK0tAcut:sVoXnF+Aj1Py4E4g+fU51L0CtAcu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C1C3F16B3CA660B2C48B457688D75939EE33FF30B7F44E44C6809676AB74787F809819
sha3_384: ab934afcb13462738d22ea6df6e7a4ab05f64ea43bb9615fe86466002817a3165868b7bfdac7109985ea0398b35745d5
ep_bytes: 0f95c4660fb6f30f91c66689d064a130
timestamp: 2005-06-02 14:55:42

Version Info:

CompanyName: †SOFTWINꊣ쉜⫽켦ӌ⮠ꆜ
훞逡uda79蠍昃룦Ꮠ樦勹㷉봔묈㲭㶛⏓熄ud841幮떾︅▿廣织먡烚ﳷ꼢慏뷹˞⁐ꑗ艢聜ꐷude3cඁ잸udaac⤼㡆᱔䐖㱣犃㲻렝ᶲቭ뵗Ⅹꏑﴝ㞥荳쭒鴩㠉敠펂≍ᐞ燸ビḢ碬纟䳉握uda21푧ᶂ䅆꾔퀮胅ѩ瑯췑熫췀螏敨࣎먣현滛䤐因兛駮쳧快㡼╘⥐㔓톖㬯頶䂍㍡꒿憢❘畊釮㍳ꌂ勸꩚㸲ᕀ翚ꍶ⑟鷂漁褰鞗ㅡ濮஍⟩䘉鰃ཬ퓈튿ꁩ镄肀馯䢝ⅈ읇udf7d凪탘毯螙ꂘҴ鼔㸁䥛梾먊暇鶨䶊≂ﰪud99aῨ핢⎶멇낷耕撼嫔砾連₏磮쐮면眈ꠥ舟끜䏇㳗勪귗钗宖㊷兾角䯷製㬒挤udcae蕇udf97뻯ᅴ⊇졜쿀㦃杩菤䱍谕㡯韛깘⚿毂﫷鶙ᝎ栯觌䵰곇握ွ㭕ោ麏祕udafa굔udf67乹䵼ꏓᮿ謍蛤辺Ქ䀟肴㺶᨝㹏ᱶ觛躷udb56䞝顋﷨ꓱ緧郷俧꽂ጤ籵ᄓ酯㣔䅍㦃㳶儘걛↬㿚ὐ뢜掩ᇉ㏨炅㼼浸敶獲潩㵮ㄢ〮•湥潣楤杮∽呕ⵆ∸猠慴摮污湯㵥礢獥㼢ാ㰊獡敳扭祬砠汭獮∽牵㩮捳敨慭⵳業牣獯景⵴潣㩭獡⹭ㅶ•慭楮敦瑳敖獲潩㵮ㄢ〮㸢਍†愼獳浥汢䥹敤瑮瑩൹ ††瘠牥楳湯∽⸱⸰⸰∰਍†††牰捯獥潳䅲捲楨整瑣牵㵥堢㘸ഢ ††渠浡㵥䴢物湡慤䴮物湡慤䴮物湡慤ഢ ††琠灹㵥眢湩㈳ഢ ⼠ാ 㰠敤捳楲瑰潩㹮䥑㱐搯獥牣灩楴湯ാ 㰠牴獵䥴普浸湬㵳產湲猺档浥獡洭捩潲潳瑦挭浯愺浳瘮∲ാ †㰠敳畣楲祴ാ ††㰠敲畱獥整偤楲楶敬敧㹳਍††††爼煥敵瑳摥硅捥瑵潩䱮癥汥਍†††††敬敶㵬愢䥳癮歯牥ഢ ††††甠䅩捣獥㵳昢污敳⼢ാ ††㰠爯煥敵瑳摥牐癩汩来獥ാ †㰠猯捥牵瑩㹹਍†⼼牴獵䥴普㹯਍⼼獡敳扭祬>:

Win32/Kryptik.ERB also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.Brsecmon.1
FireEyeGeneric.mg.820bab8512636c94
CAT-QuickHealTrojanPWS.Zbot.Y10
McAfeeGeneric PWS.lv
CylanceUnsafe
VIPRETrojan.Win32.Zbot.im (v)
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0055dd191 )
AlibabaTrojan:Win32/Kryptik.d0804421
K7GWTrojan ( 0055dd191 )
Cybereasonmalicious.512636
VirITTrojan.Win32.Generic.AYQQ
CyrenW32/FakeAlert.OG.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.ERB
APEXMalicious
ClamAVWin.Packed.Zbot-9890630-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderTrojan.Brsecmon.1
NANO-AntivirusVirus.Win32.Gen.ccmw
SUPERAntiSpywareTrojan.Agent/Gen-Backdoor[Softwin]
AvastWin32:MalOb-CK [Cryp]
RisingMalware.Undefined!8.C (TFE:1:B7C9XwosInF)
Ad-AwareTrojan.Brsecmon.1
EmsisoftTrojan.Brsecmon.1 (B)
ComodoMalware@#6cg6c3aaxczt
DrWebTrojan.PWS.Panda.487
ZillyaTrojan.Zbot.Win32.97075
TrendMicroTROJ_KRYPTK.SMM
McAfee-GW-EditionBehavesLike.Win32.Generic.ch
SophosMal/Generic-R + Mal/Zbot-IM
IkarusPacker.Win32.Krap
GDataTrojan.Brsecmon.1
JiangminTrojan/Generic.bdmo
WebrootW32.Bumat.Gen
AviraTR/Crypt.XPACK.Gen2
Antiy-AVLTrojan/Generic.ASMalwS.60F2DF
KingsoftWin32.Troj.Zbot.ar.(kcloud)
ZoneAlarmHEUR:Trojan.Win32.Generic
MicrosoftPWS:Win32/Zbot
CynetMalicious (score: 100)
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.34212.h00@aCRQGKfI
ALYacTrojan.Brsecmon.1
MAXmalware (ai score=100)
VBA32Trojan.Zeus.EA.01000
TrendMicro-HouseCallTROJ_KRYPTK.SMM
TencentMalware.Win32.Gencirc.1169c173
YandexTrojan.GenAsa!kB9FcBgV20I
SentinelOneStatic AI – Malicious PE
FortinetW32/Kryptik.AJ!tr
AVGWin32:MalOb-CK [Cryp]
PandaGeneric Malware
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Win32/Kryptik.ERB?

Win32/Kryptik.ERB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment