About "Win32/Kryptik.HAFS" infection

The Win32/Kryptik.HAFS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HAFS virus can do?

Executable code extraction
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Mimics the system’s user agent string for its own requests
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Drops a binary and executes it
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Deletes its original binary from disk
Attempts to remove evidence of file being downloaded from the Internet
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Kryptik.HAFS?


File Info:
crc32: 520647E1
md5: 15ef2d23f1a2420cb3941778083307f7
name: wVpD2nLFNxt94zxvNTS.exe
sha1: 5f9fa8d445d3d59e067d07ee8df9a3e7227a8ca9
sha256: 0853b7f54ba3560d954681937785a1c86f123128d17cfadd8fc6a2f769ddb656
sha512: a03234a50aabd505d11c03cdb1ac32450f18aebd118fb1ad7e08a87d5ef72d731450dd71b8158284fa61b4fe4e2a8da72ead2111d075f60ed384e827a2093625
ssdeep: 6144:uK1TL+6Rexa9WSU/BV5qVqc03x60Dhm+kEuS6QoJx5XpJqn3BTZe87tbiS4:umZ9WSlk13xRDhoS8x5gBU8JiS4
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2001
InternalName: WBP
FileVersion: 1, 0, 0, 1
ProductName: WBP Application
ProductVersion: 1, 0, 0, 1
FileDescription: WBP MFC Application
OriginalFilename: WBP.EXE
Translation: 0x0409 0x04b0

Win32/Kryptik.HAFS also known as:

DrWeb	Trojan.DownLoader32.47698
MicroWorld-eScan	Trojan.GenericKD.42248040
FireEye	Generic.mg.15ef2d23f1a2420c
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.42248040
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_90% (W)
BitDefenderTheta	Gen:NN.ZexaF.34082.zq1@aKqZFqfi
F-Prot	W32/Kryptik.AYJ.gen!Eldorado
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:Malware-gen
GData	Trojan.GenericKD.42248040
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Trojan:Win32/starter.ali1000037
ViRobot	Trojan.Win32.Emotet.424585
AegisLab	Trojan.Win32.Generic.4!c
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
Ad-Aware	Trojan.GenericKD.42248040
Sophos	Mal/Encpk-AOZ
TrendMicro	TrojanSpy.Win32.EMOTET.THAAEBO
McAfee-GW-Edition	BehavesLike.Win32.Ransomware.gh
Trapmine	suspicious.low.ml.score
Emsisoft	Trojan.Emotet (A)
Ikarus	Trojan-Banker.Emotet
Cyren	W32/Kryptik.AYJ.gen!Eldorado
Webroot	W32.Trojan.Emotet
Avira	TR/AD.Emotet.iagde
Endgame	malicious (high confidence)
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Emotet!rfn
AhnLab-V3	Trojan/Win32.Emotet.C3889684
Acronis	suspicious
McAfee	Emotet-FPC!15EF2D23F1A2
MAX	malware (ai score=89)
Malwarebytes	Trojan.Emotet
Panda	Trj/Emotet.A
ESET-NOD32	a variant of Win32/Kryptik.HAFS
SentinelOne	DFI – Suspicious PE
Fortinet	W32/TrickBot.CJ!tr
AVG	Win32:Malware-gen
Cybereason	malicious.445d3d
Paloalto	generic.ml

How to remove Win32/Kryptik.HAFS?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Win32/Kryptik.HAFS” infection