Win32/Kryptik.GDXL removal

The Win32/Kryptik.GDXL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GDXL virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
At least one IP Address, Domain, or File Name was found in a crypto call
A process created a hidden window
Performs some HTTP requests
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Executed a very long command line or script command which may be indicative of chained commands or obfuscation
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

github.com

fourth3-link.oss-eu-central-1.aliyuncs.com

How to determine Win32/Kryptik.GDXL?


File Info:
crc32: 80D6AF80
md5: 37b6c251fd8869ac7ad5fb621fc99ae1
name: 37B6C251FD8869AC7AD5FB621FC99AE1.mlw
sha1: c0e62c76112d2e50d7c868fe98fd7ec1cca20a1a
sha256: 1a1718c64be9351f4b937ae2377ad4fdc40436f83c7cf500c53233a86e23a970
sha512: b8a48d3c8f660e120474b8525c662f0db79ef313dcb3672bc7eaa4658bd9421781dd44db898c42a29004b0b260aede7e49c7609bcb960a204a919fde770c54dc
ssdeep: 6144:Tf3IL4Mj/4ExguprY1Q7wMDVngETqIyvEak4B10TQ+HAhuCM:zILlj/4alk1swMgETlak4B10TQ+HB
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
BuildVersion: 13, 71, 181, 3941
IncludeVersion: 13, 71, 181, 3941
Comments: File Repare Utility App A
Translation: 0x0413 0x04b0

Win32/Kryptik.GDXL also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0052d67f1 )
Lionic	Trojan.Win32.Caphaw.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Trojan.BRMon.Gen.4
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
Alibaba	Backdoor:Win32/Caphaw.c8145ed9
K7GW	Trojan ( 0052d67f1 )
Cybereason	malicious.1fd886
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/Kryptik.GDXL
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Backdoor.Win32.Caphaw.zzv
BitDefender	Trojan.BRMon.Gen.4
NANO-Antivirus	Trojan.Win32.Caphaw.fjlhvw
MicroWorld-eScan	Trojan.BRMon.Gen.4
Tencent	Win32.Backdoor.Caphaw.Llri
Ad-Aware	Trojan.BRMon.Gen.4
Sophos	ML/PE-A + Mal/EncPk-ACW
Comodo	TrojWare.Win32.Skeeyah.GD@7jn8bk
BitDefenderTheta	Gen:NN.ZexaF.34236.uq0@a0!aTPec
TrendMicro	BKDR_HPCAPHAW.SMA
FireEye	Generic.mg.37b6c251fd8869ac
Emsisoft	Trojan.BRMon.Gen.4 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.Generic.ctaxw
Avira	HEUR/AGEN.1108210
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.28A7EB4
GData	Trojan.BRMon.Gen.4
AhnLab-V3	Malware/Win32.Generic.C2425511
McAfee	GenericRXEH-TD!37B6C251FD88
MAX	malware (ai score=100)
Panda	Trj/GdSda.A
TrendMicro-HouseCall	BKDR_HPCAPHAW.SMA
Rising	Trojan.Generic@ML.90 (RDML:FRpn9HJdpok29dUI3Ez7TQ)
Yandex	Trojan.GenAsa!xGqbj+E5li8
Ikarus	Trojan.Win32.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.GDXL!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml

How to remove Win32/Kryptik.GDXL?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.GDXL removal