Malware

How to remove “Win32/Kryptik.GKHS”?

Malware Removal

The Win32/Kryptik.GKHS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Kryptik.GKHS virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family
  • Anomalous binary characteristics
  • Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Kryptik.GKHS?


File Info:

name: 3DE1B03ED16CE23429F8.mlw
path: /opt/CAPEv2/storage/binaries/18c7bce934328f4141c6beb7449fcd97c3e8149e718cb9325030f6bd94a12e8b
crc32: C2E64AF1
md5: 3de1b03ed16ce23429f82f06d594ed43
sha1: 7a31e292c454402cab01e98a8a8aeff37370a8a5
sha256: 18c7bce934328f4141c6beb7449fcd97c3e8149e718cb9325030f6bd94a12e8b
sha512: a6d240155478b4715dafeb287fc3737e61508e4e51e3beda934dce56a56f6c0d60743d676ce5b48cd93b170e0a066486c3174c44b6b33c7dee629e6b20fe6d60
ssdeep: 24576:KKaYQ4dfRa/ZM2T79pckoSxLa+iLBRH5J:KFYQ4qM2n0/+ilRZJ
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T139C52322F4E7C472D0B619B41C91C1A9661EF6E02F728EF72BD8115E4E203D16E36DA7
sha3_384: 8f17e4627efeafa875effbae727a6ef7d9a72961fb607b5404197c6bdd4524c89c7d5b979f77c154fa212457b99af8e1
ep_bytes: e80a060000e987feffff5064ff350000
timestamp: 2018-10-03 19:41:19

Version Info:

0: [No Data]

Win32/Kryptik.GKHS also known as:

LionicTrojan.Win32.Chapak.4!c
tehtrisGeneric.Malware
DrWebTrojan.SkypeSpam.11270
MicroWorld-eScanTrojan.Agent.DFZE
CAT-QuickHealTrojan.Mauvaise.SL1
SkyhighBehavesLike.Win32.Generic.vz
McAfeeGenericRXGM-MW!3DE1B03ED16C
MalwarebytesCrypt.Trojan.Malicious.DDS
VIPRETrojan.Agent.DFZE
SangforTrojan.Win32.Save.a
AlibabaTrojan:Win32/Chapak.5379ce84
K7GWTrojan ( 00538f061 )
K7AntiVirusTrojan ( 0053e6d21 )
BitDefenderThetaGen:NN.ZexaF.36804.zEW@aadxtwei
VirITTrojan.Win32.SkypeSpam.QRM
SymantecAdware.IstartSurf
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Kryptik.GKHS
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan.Win32.Chapak.axoy
BitDefenderTrojan.Agent.DFZE
NANO-AntivirusRiskware.Win32.StartSurf.fipapa
AvastWin32:Adware-gen [Adw]
RisingTrojan.Kryptik!8.8 (TFE:5:fQxm7FNoBIK)
EmsisoftApplication.Bundler (A)
GoogleDetected
F-SecureHeuristic.HEUR/AGEN.1360692
FireEyeGeneric.mg.3de1b03ed16ce234
SophosGeneric Reputation PUA (PUA)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Chapak.wv
WebrootW32.Adware.Gen
VaristW32/S-c42c122a!Eldorado
AviraHEUR/AGEN.1360692
MAXmalware (ai score=100)
Antiy-AVLTrojan/Win32.Chapak
Kingsoftmalware.kb.a.999
MicrosoftSoftwareBundler:Win32/Prepscram
XcitiumApplication.Win32.IStartSurf.PS@8c4m91
ArcabitTrojan.Agent.DFZE
ViRobotAdware.Prepscram.2514432.DA
ZoneAlarmTrojan.Win32.Chapak.axoy
GDataTrojan.Agent.DFZE
CynetMalicious (score: 100)
AhnLab-V3PUP/Win32.IStartSurf.R238501
VBA32BScope.Adware.Prepscram
ALYacTrojan.Agent.DFZE
TACHYONTrojan/W32.Chapak.2514432
Cylanceunsafe
PandaTrj/Genetic.gen
TencentMalware.Win32.Gencirc.10b271af
IkarusPUA.Win32.Prepscram
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/GenKryptik.CUPB!tr
AVGWin32:Adware-gen [Adw]
DeepInstinctMALICIOUS
alibabacloudTrojan.Win.UnkAgent

How to remove Win32/Kryptik.GKHS?

Win32/Kryptik.GKHS removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment