Categories: Malware

What is “Win32/Kryptik.FHQE”?

The Win32/Kryptik.FHQE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.FHQE virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Arabic (Tunisia)
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
Behavioural detection: Injection with CreateRemoteThread in a remote process
Behavioural detection: Transacted Hollowing

How to determine Win32/Kryptik.FHQE?


File Info:
name: E918E14E0921EDF84137.mlwpath: /opt/CAPEv2/storage/binaries/8fb14871710bd864a8615392c093b0054e5af29ff6d07ee67d03962bc6beef4fcrc32: 89019221md5: e918e14e0921edf84137c6cdae415d24sha1: e76d89ed62aad7b84872da4c997396e876195e98sha256: 8fb14871710bd864a8615392c093b0054e5af29ff6d07ee67d03962bc6beef4fsha512: 4b0a0cb1d43460ceb4d14dc57afd3f0f6e54997c97013a34ceb3abe9c2af8aa34f7d90c60177c3f35f9c55bd103e0c3d2f99275f38b09775d623d3d8a512a087ssdeep: 6144:UA0yZZ1ogJzZcNYU0Lu2Z5tB0DByhFAY9Dz:UAlZjoKa0LrZ5b0U//type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1A834E012B660CD72CAA3423650EACB52CBBAA5F3076C958377640E9D97B43F5433B643sha3_384: 303663dd69b8cdaa6cde2fbd4ed7ec0816410d9100d960db6df1a9baf91bedbe0ac6928970e4c70276ab895b26ea2f2dep_bytes: e8f7650000e916feffff8b4424045633timestamp: 2003-10-09 23:37:00
Version Info:
0: [No Data]

Win32/Kryptik.FHQE also known as:

Bkav	W32.FamVT.RazyNHmA.Trojan
Lionic	Heuristic.File.Generic.00×1!p
MicroWorld-eScan	Gen:Variant.Carberp.5
ClamAV	Win.Malware.Panda-9826376-1
FireEye	Generic.mg.e918e14e0921edf8
CAT-QuickHeal	W32.Virut.G
ALYac	Gen:Variant.Carberp.5
Cylance	Unsafe
VIPRE	Gen:Variant.Carberp.5
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004fae891 )
Alibaba	Trojan:Win32/Kryptik.c865b698
K7GW	Trojan ( 004fae891 )
Cybereason	malicious.e0921e
Baidu	Win32.Trojan.Kryptik.avc
Cyren	W32/Kryptik.GBB.gen!Eldorado
Symantec	Packed.Generic.521
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.FHQE
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Carberp.5
NANO-Antivirus	Trojan.Win32.Ruskill.ehbprc
Avast	Win32:Cryptor
Tencent	Win32.Trojan.Generic.Ydkl
Ad-Aware	Gen:Variant.Carberp.5
Emsisoft	Gen:Variant.Carberp.5 (B)
Comodo	Worm.Win32.Dorkbot.LA@6lfzlc
DrWeb	BackDoor.IRC.NgrBot.966
Zillya	Backdoor.Ruskill.Win32.4597
TrendMicro	WORM_HPKASIDET.SM0
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.dh
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
Ikarus	Trojan.Win32.Crypt
GData	Gen:Variant.Carberp.5
Jiangmin	TrojanProxy.Lethic.we
Webroot	Trojan.Dropper.Gen
Avira	HEUR/AGEN.1224026
Antiy-AVL	Trojan/Generic.ASMalwS.43F
Kingsoft	Win32.Heur.KVM013.a.(kcloud)
Arcabit	Trojan.Carberp.5
Microsoft	Worm:Win32/Dorkbot
Google	Detected
AhnLab-V3	Trojan/Win32.Upbot.R188782
Acronis	suspicious
McAfee	Artemis!E918E14E0921
MAX	malware (ai score=100)
VBA32	BScope.Trojan.Downloader
Malwarebytes	Malware.Heuristic.1001
TrendMicro-HouseCall	WORM_HPKASIDET.SM0
Rising	Trojan.Dynamer!8.3A0 (TFE:5:v6j33QE7dIR)
Yandex	Trojan.GenAsa!yQqzN/glOwc
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.7164915.susgen
Fortinet	W32/Kryptik.FIOG!tr
BitDefenderTheta	AI:Packer.CD462BE120
AVG	Win32:Cryptor
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)