Categories: Malware

Win32/Kryptik.GWAD (file analysis)

The Win32/Kryptik.GWAD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GWAD virus can do?

Executable code extraction
Creates RWX memory
Attempts to execute a powershell command with suspicious parameter/s
A process created a hidden window
Unconventionial language used in binary resources: Latvian
A scripting utility was executed
Attempts to stop active services
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Kryptik.GWAD?


File Info:
crc32: B1FD02B5md5: 3a661c4a1b02a10f5c053da8ee93da4bname: 3A661C4A1B02A10F5C053DA8EE93DA4B.mlwsha1: 40804ebd2ea85f47d103fa31705d318252bee5fesha256: 4519460e69d1223a08b1eab8ea0442aeb8639c517400ad3a8c45841ead04e2f3sha512: f877f5e25fc5ecad7522d1bbc0c8459fe17b85d3b356e9d4cf5838d8e88d26ff3b1218a492cbc9939e7ddfd3a9f148a06741edeec39b9ed197c7a7cf3ac3e198ssdeep: 6144:c2I9WeOUAQvAvXj++CfC45zlt38mdjDB7Leit1bhd3b4PeTLwal92:viOSiTtOC8t8mdXBPe2b+y92type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 2019, ghjhfkhInternalName: fghjdtjuyk.exeFileVersion: 1.0.5.4Translation: 0x0841 0x04c4

Win32/Kryptik.GWAD also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 00556fe01 )
Lionic	Trojan.Win32.Crypmod.tqHe
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.28004
MicroWorld-eScan	Trojan.GenericKDZ.57894
CAT-QuickHeal	Ransom.Stop.MP4
ALYac	Trojan.GenericKDZ.57894
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.1732083
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/CryptInject.547f88b4
K7GW	Trojan ( 00556fe01 )
Cybereason	malicious.a1b02a
Cyren	W32/Kryptik.ACJ.gen!Eldorado
Symantec	Packed.Generic.525
ESET-NOD32	a variant of Win32/Kryptik.GWAD
APEX	Malicious
Avast	Win32:Trojan-gen
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKDZ.57894
NANO-Antivirus	Trojan.Win32.Crypmod.fxtamm
Tencent	Win32.Trojan.Raas.Auto
Ad-Aware	Trojan.GenericKDZ.57894
Sophos	Mal/Generic-R + Mal/GandCrab-G
Comodo	Malware@#1rpn609doow6d
BitDefenderTheta	Gen:NN.ZexaF.34236.wu0@aS8sZ2aG
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.SMOKELOAD.SMD2.hp
McAfee-GW-Edition	BehavesLike.Win32.Rootkit.fh
FireEye	Generic.mg.3a661c4a1b02a10f
Emsisoft	Trojan.GenericKDZ.57894 (B)
Avira	HEUR/AGEN.1107506
eGambit	Unsafe.AI_Score_97%
Antiy-AVL	Trojan/Generic.ASMalwS.2C51971
GData	Win32.Trojan.Kryptik.NN
AhnLab-V3	Win-Trojan/MalPe23.Suspicious.X2005
Acronis	suspicious
McAfee	Trojan-FRIX!3A661C4A1B02
MAX	malware (ai score=85)
VBA32	TrojanDownloader.Bandit
Malwarebytes	Trojan.MalPack.GS
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.SMOKELOAD.SMD2.hp
Rising	Trojan.Generic@ML.84 (RDMK:EeXLyAwIqlNRhyEViYDLtQ)
Yandex	Trojan.Crypmod!VpCD6KPF59o
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.74534722.susgen
Fortinet	W32/Kryptik.GWBV!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml