Win32/Kryptik.HAOZ information

The Win32/Kryptik.HAOZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Kryptik.HAOZ virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX

How to determine Win32/Kryptik.HAOZ?


File Info:
crc32: 456F9922
md5: 86b773966e833505148261ad9ac37da8
name: setup.exe
sha1: add92789743fffc868b130056fafa7db4b10904f
sha256: 0edfdcfee65988aa2448a1b88ccefd351bb4c2c0226ef7d7903f3b07f0d5eeab
sha512: b62fbdd29823353a914bd0660f20d3a1cf5fd071a6e997bf2aa652f979d8086b3c6b1e7645522b967ee3dcb9f31a2062ad29084472005185a51769566b218169
ssdeep: 12288:fyZ0VJqPWGbqR89puOUIaSzUvtydE2J5TTiwbhRDt+qsaU0N5N3:fTJOJumpAIaoutydEOHhTsRK
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: Copyright xa9 2000 - 2014 KG and its Licensors OVH
InternalName: Lazy
FileVersion: 9.5.2.2
CompanyName: OVH
FileDescription: Disciplines Impactin Saves
LegalTrademarks: Copyright xa9 2000 - 2014 KG and its Licensors OVH
Comments: Disciplines Impactin Saves
ProductName: Lazy
Languages: English
ProductVersion: 9.5.2.2
PrivateBuild: 9.5.2.2
OriginalFilename: Lazy
Translation: 0x0409 0x04b0

Win32/Kryptik.HAOZ also known as:

FireEye	Generic.mg.86b773966e833505
Qihoo-360	HEUR/QVM11.1.D97B.Malware.Gen
Cybereason	malicious.9743ff
BitDefenderTheta	Gen:NN.ZexaF.34084.LmKfaOlES0bi
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Rising	Malware.Heuristic!ET#87% (RDMK:cmRtazou6QS/vNG79kpER6mDBQgI)
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
Trapmine	malicious.high.ml.score
Ikarus	Trojan-Spy.Remcos
Endgame	malicious (moderate confidence)
Microsoft	Trojan:Win32/Wacatac.C!ml
Acronis	suspicious
Cylance	Unsafe
ESET-NOD32	a variant of Win32/Kryptik.HAOZ
CrowdStrike	win/malicious_confidence_80% (D)
MaxSecure	Trojan.Malware.300983.susgen

How to remove Win32/Kryptik.HAOZ?

Win32/Kryptik.HAOZ removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X