Win32/Kryptik.GMPS (file analysis)

The Win32/Kryptik.GMPS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GMPS virus can do?

Executable code extraction
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Attempts to delete volume shadow copies
Installs itself for autorun at Windows startup
Exhibits possible ransomware file modification behavior
Creates a hidden or system file
Creates a copy of itself
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Kryptik.GMPS?


File Info:
crc32: 2565DA28
md5: ab5c360c22cba59df8d1b50bc195adf2
name: AB5C360C22CBA59DF8D1B50BC195ADF2.mlw
sha1: 6cceb03c9294c51c67602a1a83800f246801ccad
sha256: 329ae8017babdb505e38c5e3bb4fbc65c68ba5d539baa13a8c012738a4804286
sha512: 1bdc2e7fdb5e8d213488d787b347cc5ac10cc61f34bdf426f6dcff5c5ad43fd532add0e0a3c742e0cfde1cfde2ae8f29e166ddb32e827f7b3916a6f812f9aaef
ssdeep: 12288:OTFZsljuICi8bmPISRAjAG+0qC14k8N/dKAsZQ5K7u68Een:+nD5UBRo+0qCikmlsV8E+
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (c) 2014 - . All rights reserved. Unity Technologies
InternalName: Attentional
CompanyName: Unity Technologies
LegalTrademarks: Copyright (c) 2014 - . All rights reserved. Unity Technologies
Comments: Related 44100 Clapton Pursuing Routine
ProductName: Attentional
ProductVersion: 4.9.7.5
FileDescription: Related 44100 Clapton Pursuing Routine
OriginalFilename: Attentional
Translation: 0x0409 0x04b0

Win32/Kryptik.GMPS also known as:

K7AntiVirus	Trojan ( 0053ff141 )
Lionic	Trojan.Win32.Foreign.4!c
Elastic	malicious (high confidence)
McAfee	Artemis!AB5C360C22CB
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/Foreign.c47573c8
K7GW	Trojan ( 0053ff141 )
Cybereason	malicious.c22cba
ESET-NOD32	a variant of Win32/Kryptik.GMPS
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	Trojan-Ransom.Win32.Foreign.ocdz
BitDefender	Trojan.Ransomware.GenericKDS.31321411
NANO-Antivirus	Trojan.Win32.GenKryptik.fjsqhv
MicroWorld-eScan	Trojan.Ransomware.GenericKDS.31321411
Tencent	Win32.Trojan.Raas.Auto
Ad-Aware	Trojan.Ransomware.GenericKDS.31321411
Sophos	Mal/Generic-S
Comodo	Malware@#3mabz8m7cko9l
BitDefenderTheta	Gen:NN.ZexaF.34126.Dq0@aKkWG9ai
McAfee-GW-Edition	BehavesLike.Win32.Dropper.gc
FireEye	Generic.mg.ab5c360c22cba59d
Emsisoft	Trojan.Ransomware.GenericKDS.31321411 (B)
SentinelOne	Static AI – Suspicious PE
Webroot	Trojan.Dropper.Gen
Avira	HEUR/AGEN.1130350
Antiy-AVL	Trojan/Generic.ASMalwS.28C1856
Microsoft	Trojan:Win32/Occamy.B
GData	Trojan.Ransomware.GenericKDS.31321411
TACHYON	Ransom/W32.Foreign.477696.B
Acronis	suspicious
MAX	malware (ai score=88)
Malwarebytes	Spyware.AzorUlt
Panda	Trj/CI.A
Yandex	Trojan.Foreign!JOd0GQVfDrg
Ikarus	Trojan-Ransom.GandCrab
Fortinet	W32/GenKryptik.CPGW!tr.ransom
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Win32/Kryptik.GMPS?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.GMPS (file analysis)