Categories: Malware

Win32/Kryptik.GFHK malicious file

The Win32/Kryptik.GFHK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GFHK virus can do?

Behavioural detection: Executable code extraction – unpacking
Uses Windows utilities for basic functionality
Performs HTTP requests potentially not found in PCAP.
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Behavioural detection: Injection (Process Hollowing)
Behavioural detection: Injection (inter-process)
CAPE detected the embedded win api malware family
Attempts to modify proxy settings
Deletes executed files from disk
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities
Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Kryptik.GFHK?


File Info:
name: F6FB0CD7465AEC1744B1.mlwpath: /opt/CAPEv2/storage/binaries/6bddb28846ac69c46a5edf74ab3a17d7be5f728930708eba6d9bfd6fe89b5e25crc32: 77221B83md5: f6fb0cd7465aec1744b12af96b112343sha1: 1db645e1ad61c6987c47832c6e1d241ce085521asha256: 6bddb28846ac69c46a5edf74ab3a17d7be5f728930708eba6d9bfd6fe89b5e25sha512: f2f482171958ad042e59e604b2b3b91d04533b51cad9ca1b369c8b8bd644ebc0a63d6a2ffbfbc5a5311aaa6a5ea70a4bfda15fd667062fcb0c79e29556bfe0a3ssdeep: 1536:CecjaOoC4/4TMfIGBMRc2F+U+0Bwi7zmrO7oqkSZZZ3gURD8ib8f:C/LoMTqfiPBwiHmrOSUNRD5bitype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T149939D42BB15C285F8C68A300427CFF54FA1BDB5EB67C256678E730FE93F042A129A45sha3_384: f724ee5a63268f51a32c27522637487f99e5333209966651b900214cf82b96f7da43114ed1b416114233d7f510aaf756ep_bytes: 558bec81ecec010000a1ec0941008985timestamp: 1970-01-14 05:44:10
Version Info:
Comments: LegalCopyright: License: MPL 2CompanyName: Mozilla FoundationFileDescription: FileVersion: 51.0.1ProductVersion: 51.0.1InternalName: LegalTrademarks: MozillaOriginalFilename: maintenanceservice.exeProductName: FirefoxBuildID: 20170125094131Translation: 0x0000 0x04b0

Win32/Kryptik.GFHK also known as:

Elastic	malicious (high confidence)
Skyhigh	GenericRXVY-TJ!F6FB0CD7465A
Cylance	unsafe
Zillya	Downloader.Geral.Win32.13407
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.GFHK
APEX	Malicious
Kaspersky	VHO:Trojan-PSW.Win32.Fareit.gen
NANO-Antivirus	Trojan.Win32.Geral.ezpizc
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.11523f00
F-Secure	Trojan.TR/AD.Inject.gmp
DrWeb	Trojan.Chanitor.31
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.f6fb0cd7465aec17
Sophos	ML/PE-A
Jiangmin	TrojanDownloader.Geral.efc
Avira	TR/AD.Inject.gmp
Antiy-AVL	Trojan/Win32.TSGeneric
Microsoft	Trojan:Win32/Zbot.SIBD25!MTB
ZoneAlarm	VHO:Trojan-PSW.Win32.Fareit.gen
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win32.Generic.C2455461
McAfee	GenericRXVY-TJ!F6FB0CD7465A
VBA32	BScope.TrojanDownloader.Geral
Panda	Trj/GdSda.A
Yandex	Trojan.DL.Geral!7B2WIFho7bE
SentinelOne	Static AI – Suspicious PE
BitDefenderTheta	Gen:NN.ZexaF.36804.fq0@aWjW6koi
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
alibabacloud	Trojan.Win.UnkAgent