Malware

Win32/Kryptik.GVFC removal guide

Malware Removal

The Win32/Kryptik.GVFC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/Kryptik.GVFC virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid

How to determine Win32/Kryptik.GVFC?



File Info:

name: 4D7F3AEB92A07B8D0ED9.mlw
path: /opt/CAPEv2/storage/binaries/6cad03cc4421e0b1943e168ceb9985689e49b6d53e986a4febc03e3358362c9e
crc32: 568D9831
md5: 4d7f3aeb92a07b8d0ed96e815d887e97
sha1: cb37cdb3c69b0c325d48d21d15ae66232b1c151f
sha256: 6cad03cc4421e0b1943e168ceb9985689e49b6d53e986a4febc03e3358362c9e
sha512: 4716a73e9ca5dc7fcf95d7c91de48cb1a5ba14ae93121e14abd6fee2fc68320fee2b5f9870f46c40252d74e82dc842daefa0f36165f55efb1d220c09e0ed863b
ssdeep: 98304:eEI1LuMoaxR80XuogaPqZIkYHyXSB0X/GHJSEZ50yV7CGweZbpfWou:TIMGPWKu4LSgJSK0gCUo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1143633233B4D847BE8AE1B320259C699A6F2BC125F316513738AFD9F1DF01D285E1392
sha3_384: 9741bded375f209321c1989e50fa9ff6d454b370919be3ea6fb2d44aa885de13228835e914ec50769a5607b7d4145974
ep_bytes: e89e750000e97ffeffffcccccccccccc
timestamp: 2018-07-09 03:47:49


Version Info:

Comments: Nurapikebobi xetevujrikamaj yikucup soltinagi. Niyowo ruhezuhyfu xonafas yizuciki patijudagu. Tifovumohu puyow. Nasizemesas vewefebuhogij. Ziza
Translation: 0x0409 0x04e4

Win32/Kryptik.GVFC also known as:

LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
FireEyeGeneric.mg.4d7f3aeb92a07b8d
McAfeeTrojan-FRHG!4D7F3AEB92A0
CylanceUnsafe
SangforTrojan.Win32.AGEN.1043700
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderTrojan.BRMon.Gen.4
K7GWRiskware ( 0040eff71 )
K7AntiVirusRiskware ( 0040eff71 )
CyrenW32/AntiAV.I.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.GVFC
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 99)
KasperskyHEUR:Trojan.Win32.Generic
AlibabaTrojan:Win32/Kryptik.d99024f3
NANO-AntivirusTrojan.Win32.Bandit.fuybrc
MicroWorld-eScanTrojan.BRMon.Gen.4
RisingTrojan.Kryptik!1.BAD5 (CLOUD)
SophosMal/Generic-R + Mal/GandCrab-G
ComodoMalware@#343v5qwu0o8z5
VIPRETrojan.Win32.Generic!BT
TrendMicroTrojan.Win32.SODINOK.SM.hp
McAfee-GW-EditionBehavesLike.Win32.PUPXAEVB.rh
EmsisoftTrojan.BRMon.Gen.4 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Generic.eleuf
WebrootW32.Trojan.Gen
AviraHEUR/AGEN.1117660
MAXmalware (ai score=100)
Antiy-AVLTrojan/Win32.Wacatac
MicrosoftTrojanDownloader:Win32/Dofoil.BM!MTB
ViRobotTrojan.Win32.S.MazeRansom.5232640
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataTrojan.BRMon.Gen.4
AhnLab-V3Win-Trojan/MalPe34.Suspicious.X2029
VBA32BScope.Trojan.Conteban
ALYacTrojan.Ransom.ChaCha
MalwarebytesTrojan.MalPack.GS
PandaTrj/Genetic.gen
TrendMicro-HouseCallTrojan.Win32.SODINOK.SM.hp
TencentWin32.Trojan.Kryptik.Pfjz
YandexTrojan.DL.Bandit!HpWwNYukGHc
IkarusTrojan.Win32.Crypt
FortinetW32/GenKryptik.DQHN!tr
BitDefenderThetaGen:NN.ZexaF.34182.@x0@aCk0a1d
AVGWin32:CrypterX-gen [Trj]
Cybereasonmalicious.b92a07
AvastWin32:CrypterX-gen [Trj]

How to remove Win32/Kryptik.GVFC?

Win32/Kryptik.GVFC removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment