Malware

Should I remove “Win32/Kryptik.GYEQ”?

Malware Removal

The Win32/Kryptik.GYEQ file is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Win32/Kryptik.GYEQ virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Mimics the system’s user agent string for its own requests
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Deletes its original binary from disk
  • Attempts to remove evidence of file being downloaded from the Internet
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Creates a copy of itself
  • Anomalous binary characteristics

How to determine Win32/Kryptik.GYEQ?


General:

Operating System: Windows 7 / 8 / 8.1 / 10 Virus Name: DFI - Suspicious PE

File Info:

Name: S2Bqj5VvKiX7IOfm.exe

Size: 201386

Type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

MD5: 69266463113d65bf9f3d60be726f312d

SHA1: c00d413808ed5fda8eef1487f29d1bb84269e4fd

SH256: 7c4253b33a37e66a80a613da787b30c62173944f0ecdad098465bcc87808020e

Version Info:

[No Data]

Win32/Kryptik.GYEQ also known as:

ALYacTrojan.Agent.Emotet
APEXMalicious
AVGFileRepMalware
Ad-AwareTrojan.GenericKD.32698927
AegisLabTrojan.Win32.Generic.4!c
AhnLab-V3Trojan/Win32.Emotet.R298664
AlibabaTrojanBanker:Win32/Emotet.806bfe1a
Antiy-AVLTrojan[Banker]/Win32.Emotet
ArcabitTrojan.Generic.D1F2F22F
AviraTR/AD.Emotet.cxhsx
BitDefenderTrojan.GenericKD.32698927
BitDefenderThetaGen:NN.ZexaF.32248.mOX@ay8v7wp
CrowdStrikewin/malicious_confidence_90% (W)
Cybereasonmalicious.808ed5
CylanceUnsafe
CyrenW32/Emotet.AAU.gen!Eldorado
DrWebTrojan.DownLoader30.37416
ESET-NOD32a variant of Win32/Kryptik.GYEQ
Endgamemalicious (high confidence)
F-ProtW32/Emotet.AAU.gen!Eldorado
F-SecureTrojan.TR/AD.Emotet.cxhsx
FireEyeGeneric.mg.69266463113d65bf
FortinetW32/GenKryptik.DXHR!tr
GDataTrojan.GenericKD.32698927
IkarusTrojan-Banker.Emotet
Invinceaheuristic
JiangminTrojan.Banker.Emotet.mee
K7AntiVirusTrojan ( 0055b2751 )
K7GWTrojan ( 0055b2751 )
KasperskyHEUR:Trojan-Banker.Win32.Emotet.gen
MAXmalware (ai score=81)
McAfeeEmotet-FOL!69266463113D
McAfee-GW-EditionBehavesLike.Win32.Ransomware.cc
MicroWorld-eScanTrojan.GenericKD.32698927
MicrosoftTrojan:Win32/Skeeyah.A!MTB
NANO-AntivirusTrojan.Win32.GenKryptik.ggmrlt
Paloaltogeneric.ml
PandaTrj/GdSda.A
Qihoo-360Trojan.Generic
RisingTrojan.Generic@ML.86 (RDML:IrEb/5egRyIhM3lHSUEqUQ)
SentinelOneDFI – Suspicious PE
SophosMal/Generic-S
SymantecTrojan.Gen.MBT
TrendMicroTROJ_GEN.R057C0DKA19
TrendMicro-HouseCallTROJ_GEN.R057C0DKA19
VBA32Trojan.Emotet
VIPRETrojan.Win32.Generic!BT
WebrootW32.Trojan.Gen
ZoneAlarmHEUR:Trojan-Banker.Win32.Emotet.gen

How to remove Win32/Kryptik.GYEQ?

Win32/Kryptik.GYEQ removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment