Win32/Kryptik.HAWG removal

The Win32/Kryptik.HAWG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HAWG virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Performs some HTTP requests
Uses Windows utilities for basic functionality
A process attempted to delay the analysis task by a long amount of time.
Creates a hidden or system file
Attempts to modify proxy settings
Harvests information related to installed mail clients
Anomalous binary characteristics

Related domains:

www.bing.com

little-snitch.xyz

How to determine Win32/Kryptik.HAWG?


File Info:
crc32: 6AAA6C8F
md5: 922d0b9e8d2e6fe104f328550eebd11a
name: ssk.exe
sha1: cabbb6761d2260e50c4a26737f7cbb06a24c889f
sha256: eb55844a34109790b370caba8afbcafb1fd52d0575b7c031cf21a0ff74f7bbc1
sha512: ce909d6255a01e2fe56c0033c0033f911e573ce164a094b2188c94a3cba776156e0355202cfe7901dd79f7b0609de9492d3e73d9f4840a76c1e3c61affca64c1
ssdeep: 49152:VIX9X/44TGwwXVVJM7GmW828Zc9ljNCefWPnVJ6nFkrwqp+vtQwN/z:VSX3TGwOVE7GmZ28Zc9ljNCe+PWFkdp
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Licensed under the GNU GPL, v3.
InternalName: Pass Everywonder
FileVersion: 15.3.44.28
CompanyName: Example ChaiOne
ProductName: Pass Everywonder
ProductVersion: 15.3.44.28
FileDescription: Pass Everywonder
OriginalFilename: Pass Everywonder.exe
Translation: 0x0409 0x04b0

Win32/Kryptik.HAWG also known as:

MicroWorld-eScan	Trojan.GenericKD.33043981
FireEye	Trojan.GenericKD.33043981
McAfee	Artemis!922D0B9E8D2E
Cylance	Unsafe
K7AntiVirus	Trojan ( 0055ffa11 )
BitDefender	Trojan.GenericKD.33043981
APEX	Malicious
Paloalto	generic.ml
GData	Win32.Trojan-Spy.Ursnif.GPXZIV
Kaspersky	Trojan-Banker.Win32.Cridex.iql
AegisLab	Trojan.Multi.Generic.4!c
Endgame	malicious (high confidence)
Emsisoft	Trojan.GenericKD.33043981 (B)
F-Secure	Trojan.TR/AD.UrsnifDropper.rghtu
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Crypt
Webroot	W32.Malware.Gen
Avira	TR/AD.UrsnifDropper.rghtu
MAX	malware (ai score=82)
Microsoft	Trojan:Win32/Wacatac.C!ml
Arcabit	Trojan.Generic.D1F8360D
ZoneAlarm	Trojan-Banker.Win32.Cridex.iql
AhnLab-V3	Malware/Win32.Generic.C3980621
Ad-Aware	Trojan.GenericKD.33043981
ESET-NOD32	a variant of Win32/Kryptik.HAWG
Rising	Trojan.Kryptik!8.8 (CLOUD)
Fortinet	W32/GenKryptik.ECJC!tr
BitDefenderTheta	Gen:NN.ZexaF.34084.Rv0@au4BGOoi
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_60% (W)

How to remove Win32/Kryptik.HAWG?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.HAWG removal