Win32/Kryptik.GHOR (file analysis)

The Win32/Kryptik.GHOR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GHOR virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process attempted to delay the analysis task.
A process created a hidden window
Unconventionial language used in binary resources: Czech
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Attempts to repeatedly call a single API many times in order to delay analysis time
Uses suspicious command line tools or Windows utilities

Related domains:

m.nottra.pw

m.lomoni.be

How to determine Win32/Kryptik.GHOR?


File Info:
crc32: 1651E0FD
md5: c350223696297e61657e5fc46b9ff2d7
name: C350223696297E61657E5FC46B9FF2D7.mlw
sha1: b2b5379007bebfed57448957649b4c3099a5271a
sha256: a8b62bd3bafa2ca9932f38b1fe96a72c944a5a0d8f8b873853102beaa8f5edc9
sha512: c6dae8895848077264f2f8ba6929edfc2a0c108e8359b385b417f28ec57129bc52866915fbe188c1f2176569fcd71dc5048b937938ae1a6cb3fac288024b0eab
ssdeep: 24576:YMi0bt2AYWzQactkHf5bsnGtYY8uAAk9mjEKfzONeNb5x3okkE+wTZSaYKD20Hm:K2tnzaaRAnch
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2017, masasrfure
InternalName: sgahagajfgha.exe
FileVersion: 1.0.0.1
ProductVersion: 1.0.0.1
Translation: 0x0809 0x04b0

Win32/Kryptik.GHOR also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 0052695d1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader26.17064
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	GenericRXAA-AA!C35022369629
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
K7GW	Trojan ( 0052695d1 )
Cybereason	malicious.696297
Cyren	W32/Ransom.JE.gen!Eldorado
Symantec	Packed.Generic.525
ESET-NOD32	a variant of Win32/Kryptik.GHOR
APEX	Malicious
Avast	FileRepMetagen [Malware]
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.BRMon.Gen.1
NANO-Antivirus	Trojan.Win32.Miner.exylur
SUPERAntiSpyware	Trojan.Agent/Gen-Suloc
MicroWorld-eScan	Trojan.BRMon.Gen.1
Tencent	Win32.Trojan.Generic.Swke
Ad-Aware	Trojan.BRMon.Gen.1
Sophos	Mal/GandCrab-B
Comodo	TrojWare.Win32.Ransom.GandCrypt.B@7ikv0k
BitDefenderTheta	Gen:NN.ZexaF.34722.ez1@aGXw1LkG
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_HPGANDCRAB.SMONT
McAfee-GW-Edition	BehavesLike.Win32.Lockbit.tc
FireEye	Generic.mg.c350223696297e61
Emsisoft	Trojan.BRMon.Gen.1 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan.GandCrypt.q
Webroot	W32.Trojan.Gen
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.24E0938
Microsoft	Ransom:Win32/GandCrab.AU!bit
AegisLab	Trojan.Win32.Miner.4!c
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.BRMon.Gen.1
AhnLab-V3	Win-Trojan/MalPe34.Suspicious.X2029
Acronis	suspicious
VBA32	Trojan.Miner
MAX	malware (ai score=100)
Malwarebytes	Trojan.MalPack
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Ransom_HPGANDCRAB.SMONT
Rising	Malware.Obscure/Heur!1.9E03 (CLASSIC)
Yandex	Trojan.GenAsa!+nIhj0/SbZY
Ikarus	Trojan.Win32.Krypt
MaxSecure	Ransomeware.GandCrypt.Gen
Fortinet	W32/GenKryptik.CNAR!tr
AVG	FileRepMetagen [Malware]
Paloalto	generic.ml

How to remove Win32/Kryptik.GHOR?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.GHOR (file analysis)