Win32/Kryptik.GDXP (file analysis)

The Win32/Kryptik.GDXP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Kryptik.GDXP virus can do?

Presents an Authenticode digital signature
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32/Kryptik.GDXP?


File Info:
name: 16C3B5FEB24F65B06EF0.mlw
path: /opt/CAPEv2/storage/binaries/47e5c9f8624abdd33860d59c61de709650b40860e1946e0430a1fe3c06aba7b2
crc32: 836C6956
md5: 16c3b5feb24f65b06ef088eadaf4ac83
sha1: 37cb643ca512a90ef2166c2f3396d10b3f134722
sha256: 47e5c9f8624abdd33860d59c61de709650b40860e1946e0430a1fe3c06aba7b2
sha512: 9a3379149e5d5506e4231176cb1a0978f8a6f23f26c6de734b9efafd32ee7332e817c92d4cb63b786cd32eb16426bbdf31d35c0932e18eea721e29d737025f53
ssdeep: 49152:7DmW2ATnvcO4zyPq3+AQ/R6YVV+0e5LpQ:8A7vcOhPq3+Aa0Y//edK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E1A59ECA7310EB05C06BF577C8CB0DEA46297E29D892641750C53CFE33B19699EE126E
sha3_384: 7521876f59dfead24ce320b42584d208778361572cf7e4a8f43e54d9d53eb442258d8753ca0f5b473bc53eff88873574
ep_bytes: 80ffffffff685852400068ec2e400064
timestamp: 2018-03-06 04:50:09

Version Info:
CompanyName: McAfee, Inc.
FileDescription: Security Scanner Startup DLL
FileVersion: 3,11,500,0
InternalName: SecurityScanner
LegalCopyright: Copyright © 2016 McAfee, Inc.
OriginalFilename: SecurityScanner.dll
ProductName: McAfee Security Scanner +
ProductVersion: 3,11,0,0
Translation: 0x0409 0x00b0

Win32/Kryptik.GDXP also known as:

Bkav	W32.AIDetect.malware2
Lionic	Hacktool.Win32.Katusha.x!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Autoruns.GenericKD.32175649
FireEye	Generic.mg.16c3b5feb24f65b0
ALYac	Trojan.Autoruns.GenericKD.32175649
Malwarebytes	Malware.AI.1243430108
Zillya	Trojan.Kryptik.Win32.1373432
K7AntiVirus	Trojan ( 0052974b1 )
Alibaba	Trojan:Win32/Katusha.25754e87
K7GW	Trojan ( 0052974b1 )
Cybereason	malicious.eb24f6
BitDefenderTheta	Gen:NN.ZexaF.34084.fA2@a0N8V8hi
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.GDXP
TrendMicro-HouseCall	Trojan.Win32.EKSTAK.SM
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Packed.Win32.Katusha.gen
BitDefender	Trojan.Autoruns.GenericKD.32175649
NANO-Antivirus	Riskware.Win32.BitCoinMiner.eyqjnb
Tencent	Malware.Win32.Gencirc.10c8af30
Ad-Aware	Trojan.Autoruns.GenericKD.32175649
Sophos	ICLoader (PUA)
Comodo	TrojWare.Win32.SpyEyes.BSWP@7k7ll0
DrWeb	Trojan.BtcMine.2428
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.EKSTAK.SM
McAfee-GW-Edition	BehavesLike.Win32.Downloader.vc
Emsisoft	Trojan.Autoruns.GenericKD.32175649 (B)
APEX	Malicious
Jiangmin	RiskTool.Generic.ilk
MaxSecure	Trojan.Malware.121218.susgen
Avira	TR/Crypt.XPACK.Gen2
Antiy-AVL	Trojan/Generic.ASMalwS.24F8307
GData	Trojan.Autoruns.GenericKD.32175649
AhnLab-V3	Trojan/Win32.CoinMiner.R222150
Acronis	suspicious
VBA32	BScope.Trojan.BtcMine
MAX	malware (ai score=98)
Rising	Trojan.CoinMiner!1.AFF9 (CLASSIC)
Yandex	Trojan.GenAsa!gIEb810CzWE
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_50%
Fortinet	W32/GenKryptik.BSHP!tr
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_80% (W)

How to remove Win32/Kryptik.GDXP?

Win32/Kryptik.GDXP removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X