Categories: Malware

Win32/Kryptik.GSES removal

The Win32/Kryptik.GSES is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GSES virus can do?

Unconventionial language used in binary resources: Tamil
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Authenticode signature is invalid
Attempts to repeatedly call a single API many times in order to delay analysis time
Anomalous binary characteristics
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/Kryptik.GSES?


File Info:
name: 1544DBC6070D61F55684.mlwpath: /opt/CAPEv2/storage/binaries/79a8e48640aa555706981e261c64bbb3e82259b08fc86c45466cd6e9668ca8c8crc32: EB2D135Dmd5: 1544dbc6070d61f556847788f231ad8asha1: cf0b9ff0bfc76399e8b99f55174e63d6f3d85ad2sha256: 79a8e48640aa555706981e261c64bbb3e82259b08fc86c45466cd6e9668ca8c8sha512: 7215673376239030b38cd47dd72f640267a1ae4521b15a8632a9891febb2a0b531101688c8725ca9950b0d9b865029bce7d6a17cf90bc3ff6598182f9af96347ssdeep: 12288:3Bx2YNF5OSxIw0UY86xgXDjOiZTK2+F/7e+f1YTjXHri8XYVa7glvG8n553:RpTtFjuxgPOiZ5+OFXstpG85Ntype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10415E1266868BF09D423B234B10B2F7685F58F1F7B26155DEAFE3FB1B1746105A2304Asha3_384: aab4f16b5d975223f01b12650aef23f12bc6a9f9ab1d48568baa13179766e8752cf70a8e888a9f9d30fd68ee5475c201ep_bytes: 60be003097068dbe00e0a8f957eb0b90timestamp: 2017-12-22 21:01:47
Version Info:
0: [No Data]

Win32/Kryptik.GSES also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Chapak.4!c
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Variant.Barys.326335
ALYac	Gen:Variant.Barys.326335
Malwarebytes	Trojan.MalPack.GS
Zillya	Trojan.Chapak.Win32.76681
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0054c3641 )
Alibaba	Trojan:Win32/Starter.ali2000005
K7GW	Trojan ( 0054c3641 )
Cybereason	malicious.6070d6
Cyren	W32/Kryptik.WT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.GSES
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Ursu-7052952-1
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Barys.326335
NANO-Antivirus	Trojan.Win32.Chapak.fpevve
Avast	Win32:Trojan-gen
Rising	Trojan.Kryptik!8.8 (CLOUD)
Emsisoft	Gen:Variant.Barys.326335 (B)
VIPRE	Gen:Variant.Bulz.389072
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.1544dbc6070d61f5
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.PSW.Azorult.bac
Avira	HEUR/AGEN.1230245
Antiy-AVL	Trojan/Win32.Chapak
Microsoft	Trojan:Win32/Gandcrab.AF
Xcitium	Malware@#3p1p5v4ps05nx
Arcabit	Trojan.Bulz.D5EFD0
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Barys.326335
Google	Detected
AhnLab-V3	Trojan/Win32.MalPe.R265247
Acronis	suspicious
McAfee	Artemis!1544DBC6070D
MAX	malware (ai score=100)
VBA32	BScope.Adware.Puwaders
Cylance	unsafe
Tencent	Win32.Trojan.Generic.Rqil
Yandex	Trojan.Chapak!xzPN1OPzkok
Ikarus	Trojan.Dofoil
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.GEI!tr
BitDefenderTheta	Gen:NN.ZexaF.36308.3mGfa8V88MPG
AVG	Win32:Trojan-gen
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_90% (D)