Categories: Malware

What is “Win32/Kryptik.GUSY”?

The Win32/Kryptik.GUSY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GUSY virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
A process created a hidden window
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Punjabi
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Attempts to modify proxy settings
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

ghjhk45y4.xyz

wpad.local-net

How to determine Win32/Kryptik.GUSY?


File Info:
name: FEF2101D115930611749.mlwpath: /opt/CAPEv2/storage/binaries/35523400a6d86ad3d08ecfa4b81128981169a14f7c198e0b80cdbf1f218015f6crc32: F2DCE012md5: fef2101d115930611749f7007795a008sha1: 73c16f042f40ef4b04aaa1f715f528b2334d14ebsha256: 35523400a6d86ad3d08ecfa4b81128981169a14f7c198e0b80cdbf1f218015f6sha512: 4d933336d9f6a93b0a46616ad9aa0312a88ac7974d58a8886e46beb919dc4f60b313ac5a70299045d287e85b923d33c2c9b59a278b583cbc183b6223c01049afssdeep: 3072:gZDppBXy+isjRdWA+8zSV4WfRZ6m0u+bcIPrvW/58Rfr76JS83oZoB:SpXyvs/5vzT+ZcXPrva58RfrmvqoBtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T18314CF1075E084B2EBF7277249B48B094B6DFD754B717ACB3388129D4E606D0AB367A3sha3_384: 8a196a4c3b71af9385fde8a61a4360089249d607648d6cad45c416128e4b3ec931ffc4ee68b2c9cd0cbd3f3875174dbcep_bytes: e808500000e97ffeffffcccccccccccctimestamp: 2018-07-23 13:18:31
Version Info:
0: [No Data]

Win32/Kryptik.GUSY also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Chapak.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.BrsecmonE.1
CAT-QuickHeal	Ransom.Stop.MP4
ALYac	Trojan.BrsecmonE.1
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 00552dee1 )
Alibaba	Trojan:Win32/Chapak.8fa0dd88
K7GW	Trojan ( 00552dee1 )
Cybereason	malicious.d11593
Symantec	Packed.Generic.525
ESET-NOD32	a variant of Win32/Kryptik.GUSY
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.BrsecmonE.1
NANO-Antivirus	Trojan.Win32.Chapak.ftmaxh
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Generic.Ejew
Ad-Aware	Trojan.BrsecmonE.1
Emsisoft	Trojan.BrsecmonE.1 (B)
Comodo	TrojWare.Win32.TrojanDownloader.Bandit.C@8cwa34
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
FireEye	Generic.mg.fef2101d11593061
Sophos	Mal/Generic-S + Mal/GandCrab-G
Ikarus	Trojan.Krypt
GData	Trojan.BrsecmonE.1
Jiangmin	Trojan.Chapak.fff
Webroot	W32.Adware.Gen
Avira	TR/AD.Khalesi.wwp
Antiy-AVL	Trojan/Generic.ASMalwS.2C0E50F
Arcabit	Trojan.BrsecmonE.1
Microsoft	Trojan:Win32/Gandcrab.AF
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Gandcrab.R282471
Acronis	suspicious
McAfee	Trojan-FRGI!FEF2101D1159
MAX	malware (ai score=81)
VBA32	BScope.Trojan.Chapak
Malwarebytes	Trojan.MalPack.GS
Rising	Malware.Obscure/Heur!1.A89E (CLASSIC)
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Kryptik.GUUL!tr
BitDefenderTheta	Gen:NN.ZexaF.34294.myW@aye5HwiG
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Trojan.Malware.300983.susgen