Categories: Malware

Should I remove “Win32/Kryptik.ERB”?

The Win32/Kryptik.ERB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Kryptik.ERB virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • Unconventionial language used in binary resources: Russian
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Win32/Kryptik.ERB?


File Info:

name: 820BAB8512636C943666.mlwpath: /opt/CAPEv2/storage/binaries/52721cb47809b07d80eb27de719334b5acbabf727f1fb9f428e519afc68cda6bcrc32: 258238D6md5: 820bab8512636c94366696c816144fa9sha1: 144bf5fe3c09cfe33941bd92a53912580845a8dcsha256: 52721cb47809b07d80eb27de719334b5acbabf727f1fb9f428e519afc68cda6bsha512: 9520d41f84dc5e9cf5e6bdc5804db7fbc3c7c8869bf1ab4fb3ed2455135e6f4c117bb10e1a0ca9771d153ea999ea31d5da47b3e5595b57579a8882f03ef99db7ssdeep: 768:sgnwTojbNK1VYL7YynFU5CEuNca1DiEDOg3E4gW4OaYU5SGLEdqK0tAcut:sVoXnF+Aj1Py4E4g+fU51L0CtAcutype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C1C3F16B3CA660B2C48B457688D75939EE33FF30B7F44E44C6809676AB74787F809819sha3_384: ab934afcb13462738d22ea6df6e7a4ab05f64ea43bb9615fe86466002817a3165868b7bfdac7109985ea0398b35745d5ep_bytes: 0f95c4660fb6f30f91c66689d064a130timestamp: 2005-06-02 14:55:42

Version Info:

CompanyName: †SOFTWINꊣ쉜⫽켦ӌ⮠ꆜ훞逡uda79蠍昃룦Ꮠ樦勹㷉봔묈㲭㶛⏓熄ud841幮떾︅▿廣织먡烚ﳷ꼢慏뷹˞⁐ꑗ艢聜ꐷude3cඁ잸udaac⤼㡆᱔䐖㱣犃㲻렝ᶲቭ뵗Ⅹꏑﴝ㞥荳쭒鴩㠉敠펂≍ᐞ燸ビḢ碬纟䳉握uda21푧ᶂ䅆꾔퀮胅ѩ瑯췑熫췀螏敨࣎먣현滛䤐因兛駮쳧快㡼╘⥐㔓톖㬯頶䂍㍡꒿憢❘畊釮㍳ꌂ勸꩚㸲ᕀ翚ꍶ⑟鷂漁褰鞗ㅡ濮஍⟩䘉鰃ཬ퓈튿ꁩ镄肀馯䢝ⅈ읇udf7d凪탘毯螙ꂘҴ鼔㸁䥛梾먊暇鶨䶊≂ﰪud99aῨ핢⎶멇낷耕撼嫔砾連₏磮쐮면眈ꠥ舟끜䏇㳗勪귗钗宖㊷兾角䯷製㬒挤udcae蕇udf97뻯ᅴ⊇졜쿀㦃杩菤䱍谕㡯韛깘⚿毂﫷鶙ᝎ栯觌䵰곇握ွ㭕ោ麏祕udafa굔udf67乹䵼ꏓᮿ謍蛤辺Ქ䀟肴㺶᨝㹏ᱶ觛躷udb56䞝顋﷨ꓱ緧郷俧꽂ጤ籵ᄓ酯㣔䅍㦃㳶儘걛↬㿚ὐ뢜掩ᇉ㏨炅㼼浸敶獲潩㵮ㄢ〮•湥潣楤杮∽呕ⵆ∸猠慴摮污湯㵥礢獥㼢ാ㰊獡敳扭祬砠汭獮∽牵㩮捳敨慭⵳業牣獯景⵴潣㩭獡⹭ㅶ•慭楮敦瑳敖獲潩㵮ㄢ〮㸢਍†愼獳浥汢䥹敤瑮瑩൹ ††瘠牥楳湯∽⸱⸰⸰∰਍†††牰捯獥潳䅲捲楨整瑣牵㵥堢㘸ഢ ††渠浡㵥䴢物湡慤䴮物湡慤䴮物湡慤ഢ ††琠灹㵥眢湩㈳ഢ ⼠ാ 㰠敤捳楲瑰潩㹮䥑㱐搯獥牣灩楴湯ാ 㰠牴獵䥴普浸湬㵳產湲猺档浥獡洭捩潲潳瑦挭浯愺浳瘮∲ാ †㰠敳畣楲祴ാ ††㰠敲畱獥整偤楲楶敬敧㹳਍††††爼煥敵瑳摥硅捥瑵潩䱮癥汥਍†††††敬敶㵬愢䥳癮歯牥ഢ ††††甠䅩捣獥㵳昢污敳⼢ാ ††㰠爯煥敵瑳摥牐癩汩来獥ാ †㰠猯捥牵瑩㹹਍†⼼牴獵䥴普㹯਍⼼獡敳扭祬>:

Win32/Kryptik.ERB also known as:

Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Brsecmon.1
FireEye Generic.mg.820bab8512636c94
CAT-QuickHeal TrojanPWS.Zbot.Y10
McAfee Generic PWS.lv
Cylance Unsafe
VIPRE Trojan.Win32.Zbot.im (v)
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0055dd191 )
Alibaba Trojan:Win32/Kryptik.d0804421
K7GW Trojan ( 0055dd191 )
Cybereason malicious.512636
VirIT Trojan.Win32.Generic.AYQQ
Cyren W32/FakeAlert.OG.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.ERB
APEX Malicious
ClamAV Win.Packed.Zbot-9890630-0
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Trojan.Brsecmon.1
NANO-Antivirus Virus.Win32.Gen.ccmw
SUPERAntiSpyware Trojan.Agent/Gen-Backdoor[Softwin]
Avast Win32:MalOb-CK [Cryp]
Rising Malware.Undefined!8.C (TFE:1:B7C9XwosInF)
Ad-Aware Trojan.Brsecmon.1
Emsisoft Trojan.Brsecmon.1 (B)
Comodo Malware@#6cg6c3aaxczt
DrWeb Trojan.PWS.Panda.487
Zillya Trojan.Zbot.Win32.97075
TrendMicro TROJ_KRYPTK.SMM
McAfee-GW-Edition BehavesLike.Win32.Generic.ch
Sophos Mal/Generic-R + Mal/Zbot-IM
Ikarus Packer.Win32.Krap
GData Trojan.Brsecmon.1
Jiangmin Trojan/Generic.bdmo
Webroot W32.Bumat.Gen
Avira TR/Crypt.XPACK.Gen2
Antiy-AVL Trojan/Generic.ASMalwS.60F2DF
Kingsoft Win32.Troj.Zbot.ar.(kcloud)
ZoneAlarm HEUR:Trojan.Win32.Generic
Microsoft PWS:Win32/Zbot
Cynet Malicious (score: 100)
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34212.h00@aCRQGKfI
ALYac Trojan.Brsecmon.1
MAX malware (ai score=100)
VBA32 Trojan.Zeus.EA.01000
TrendMicro-HouseCall TROJ_KRYPTK.SMM
Tencent Malware.Win32.Gencirc.1169c173
Yandex Trojan.GenAsa!kB9FcBgV20I
SentinelOne Static AI – Malicious PE
Fortinet W32/Kryptik.AJ!tr
AVG Win32:MalOb-CK [Cryp]
Panda Generic Malware
CrowdStrike win/malicious_confidence_100% (W)

How to remove Win32/Kryptik.ERB?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

MSIL/GenKryptik.GXIZ information

The MSIL/GenKryptik.GXIZ is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

Malware.AI.2789448175 (file analysis)

The Malware.AI.2789448175 is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

Jalapeno.1878 removal instruction

The Jalapeno.1878 is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

What is “Trojan.Heur3.LPT.YmKfaKBcBekib”?

The Trojan.Heur3.LPT.YmKfaKBcBekib is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

How to remove “Worm.Win32.Vobfus.exmt”?

The Worm.Win32.Vobfus.exmt is considered dangerous by lots of security experts. When this infection is active,…

2 months ago

About “TrojanDownloader:Win32/Beebone.JO” infection

The TrojanDownloader:Win32/Beebone.JO is considered dangerous by lots of security experts. When this infection is active,…

2 months ago