Categories: Malware

Win32/Kryptik.GMTZ malicious file

The Win32/Kryptik.GMTZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GMTZ virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (3 unique times)
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Installs itself for autorun at Windows startup
Creates a slightly modified copy of itself

Related domains:

cypruns.com

importhe.com

How to determine Win32/Kryptik.GMTZ?


File Info:
crc32: 59C7F6D5md5: 3185ea19420dda27fe9d401599f48076name: 3185EA19420DDA27FE9D401599F48076.mlwsha1: 2e23f63da6efac6073d8df50ba8545a3066224c0sha256: 21683333c895278fbfc0327d851b5711d43e1df1bec2acd889899c2ad85f048esha512: b1e2022c9bb1060304bcb0f5c5de6314c8f9c38cf4e5bd2bfd038890925ce6cd5704dbbc60b8cd48b128b4c142e364373c92f52aab4d27525f35fbeb9f67a12essdeep: 3072:RV0mtquRo8Nx2LRKLGshyXUUA78+P9qBqnqLnhe:RVi45xojVXUUA7XKetype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright xa9 2015-2017 Dinerware Able, Inc.InternalName: shoutown.exeFileVersion: 15.6.51.44CompanyName: Dinerware AbleProductName: OncemindProductVersion: 15.6.51.44FileDescription: OncemindOriginalFilename: shoutown.exeTranslation: 0x0409 0x04b0

Win32/Kryptik.GMTZ also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 005413421 )
Lionic	Trojan.Win32.IcedID.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.IcedID.15
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Mauvaise.SL1
ALYac	Trojan.Spy.IcedId.C
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDropper:Win32/dropper.ali1003001
K7GW	Trojan ( 005413421 )
Cybereason	malicious.9420dd
Cyren	W32/Agent.BDN.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.GMTZ
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Dropper.IcedID-7070617-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Spy.IcedId.C
NANO-Antivirus	Trojan.Win32.IcedID.fnsfxq
MicroWorld-eScan	Trojan.Spy.IcedId.C
Tencent	Malware.Win32.Gencirc.10b4bda1
Ad-Aware	Trojan.Spy.IcedId.C
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.IcedID.TZ@7yn3ds
BitDefenderTheta	Gen:NN.ZexaF.34294.ru0@aWG0OMbi
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dt
FireEye	Generic.mg.3185ea19420dda27
Emsisoft	Trojan.Spy.IcedId.C (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Banker.IcedID.dh
Avira	HEUR/AGEN.1136031
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.29491F9
Microsoft	Trojan:Win32/Occamy.C
SUPERAntiSpyware	Trojan.Agent/Gen-Banker
GData	Trojan.Spy.IcedId.C
AhnLab-V3	Malware/Win32.Generic.C2832118
Acronis	suspicious
McAfee	Ursnif-FQLY!3185EA19420D
MAX	malware (ai score=83)
VBA32	TrojanBanker.IcedID
Malwarebytes	Malware.AI.4185406120
Panda	Trj/Genetic.gen
Rising	Trojan.Generic@ML.92 (RDML:J/wOM+Ll8zUG18z3yhA75Q)
Yandex	Trojan.PWS.IcedID!b7mcbgh2pQw
Ikarus	Trojan.Crypt
Fortinet	W32/GenKryptik.CRRJ!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml