Categories: Malware

Should I remove “Win32/Kryptik.GNZX”?

The Win32/Kryptik.GNZX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GNZX virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Network activity detected but not expressed in API logs

Related domains:

wpad.local-net

How to determine Win32/Kryptik.GNZX?


File Info:
name: 0FCAEE539537D65CC755.mlwpath: /opt/CAPEv2/storage/binaries/2a98e72a1562ccec8fc7caba7742da483e4d20bfa8009d7a8615f9d84c242693crc32: 41F91210md5: 0fcaee539537d65cc755fd8ae0467562sha1: ee1de0b92780d8f2824fa7545d1b8fdcbd2c3979sha256: 2a98e72a1562ccec8fc7caba7742da483e4d20bfa8009d7a8615f9d84c242693sha512: 5f576da802f46faa80161394e4264a757361e492b1e72bd8c176b3378920c583c45bffa392b8397d153611f1e7b6fd02276b8778ae9075d1f1afaa22a1532795ssdeep: 24576:IcOBOIVCBl1oLGbPejcivrfECf6Pj+BCzPMqXr4QYmFI:IcOvCBl1nbWAizl6PjCC2QY+Itype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14015BD213FE5D5A3E44A2A37CC34C6FC4824BDC9CEB4449B26E5FB4F76B608246A5D42sha3_384: 6a9ad8897d115457a1fb3bc500971d9cdfd6d139ffbe047fdea9d1c71e973598e1dbf12f0526f05cd20cd8ed2c264a0aep_bytes: e8822e0000e9000000006a1468e02e4ctimestamp: 2014-12-19 11:46:11
Version Info:
0: [No Data]

Win32/Kryptik.GNZX also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Nymaim.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.0fcaee539537d65c
McAfee	Artemis!0FCAEE539537
Cylance	Unsafe
Zillya	Trojan.Nymaim.Win32.11410
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005441711 )
Alibaba	Trojan:Win32/Nymaim.400ba146
K7GW	Trojan ( 005441711 )
Cybereason	malicious.39537d
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.GNZX
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Nymaim.bmmw
BitDefender	Trojan.GenericKD.40851456
NANO-Antivirus	Trojan.Win32.Nymaim.flhttw
MicroWorld-eScan	Trojan.GenericKD.40851456
Avast	FileRepMalware
Tencent	Malware.Win32.Gencirc.114d7c41
Ad-Aware	Trojan.GenericKD.40851456
Emsisoft	Trojan.GenericKD.40851456 (B)
Comodo	Malware@#3u6khi5pzg0cs
DrWeb	Trojan.Nymaim.226
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKD.40851456
Jiangmin	Trojan.Nymaim.epk
Webroot	W32.Trojan.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.29F279E
Microsoft	Trojan:Win32/Occamy.C
AhnLab-V3	Malware/Win32.Generic.C2901351
VBA32	Trojan.Nymaim
ALYac	Trojan.GenericKD.40851456
MAX	malware (ai score=85)
Rising	Trojan.Generic@ML.100 (RDML:QjPx3q99VKOiKzmVh6pbng)
Yandex	Trojan.Nymaim!axQjYkAU28w
Ikarus	Trojan.Ursnif
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/GenKryptik.CUBY!tr
BitDefenderTheta	AI:Packer.FD18BFCA21
AVG	FileRepMalware
Panda	Trj/GdSda.A