Categories: Malware

Win32/Kryptik.HCGS (file analysis)

The Win32/Kryptik.HCGS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HCGS virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
Expresses interest in specific running processes
A process created a hidden window
Unconventionial language used in binary resources: Hindi
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Checks the CPU name from registry, possibly for anti-virtualization
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

onlynew.xyz

How to determine Win32/Kryptik.HCGS?


File Info:
crc32: 45A749CAmd5: a59b6178979a69c35e1d97b7bba77fb2name: stardock20start10201-RTMD-aehyev4jjaaavhwcaerffwamadxonaia.exesha1: 7884b6164ab16443d8a134591de824b686320eedsha256: a45499c9643ccb1bc3cadfcdafbc75c4f415bcf05533cd234854e37a7a5e7875sha512: 65fa155e13084e7aa123a8226679789f51dc151538a52f53ec6ab9a36a722aa94e39b8de2da2d5cb54f3768fb6e3a7f7b2ccf899b546ac0ac8134b50bae2db02ssdeep: 49152:yVpsbTX/+vIU4acFN2y3llSP4NqzZXQcExs5wCvxZim73oUZrDcy4Wx+SIDrIil:yAkcn7SPUiIR2xUUJGWxevpSMr6oqubtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
FileVersionNew: 2.3.4InternalServiceName: speedy.exeCopyright: Copyright (C) 2020, softtailProgramVersion: 1.4.7

Win32/Kryptik.HCGS also known as:

Bkav	W32.AIDetectVM.malware
MicroWorld-eScan	Trojan.GenericKD.33567430
FireEye	Generic.mg.a59b6178979a69c3
McAfee	Artemis!A59B6178979A
Malwarebytes	Trojan.Glupteba
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Malicious.4!c
CrowdStrike	win/malicious_confidence_90% (W)
BitDefender	Trojan.GenericKD.33567430
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
TrendMicro	TROJ_GEN.R011C0DCR20
BitDefenderTheta	Gen:NN.ZexaF.34104.WtW@aiw4y1bG
Cyren	W32/Trojan.FCAU-3442
TrendMicro-HouseCall	TROJ_GEN.R011C0DCR20
Avast	Win32:CoinminerX-gen [Trj]
GData	Trojan.GenericKD.33567430
Kaspersky	Backdoor.Win32.Androm.txhw
Alibaba	Backdoor:Win32/Glupteba.00456ad3
ViRobot	Trojan.Win32.Z.Agent.3947520
APEX	Malicious
Tencent	Win32.Backdoor.Androm.Lmul
Ad-Aware	Trojan.GenericKD.33567430
Sophos	Mal/RyPack-A
F-Secure	Trojan.TR/Crypt.XPACK.Gen3
DrWeb	Trojan.Siggen9.26189
McAfee-GW-Edition	BehavesLike.Win32.Generic.wc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.33567430 (B)
SentinelOne	DFI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Avira	TR/Crypt.XPACK.Gen3
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Win32.Wacatac
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D20032C6
ZoneAlarm	Backdoor.Win32.Androm.txhw
Microsoft	PWS:Win32/Predator.KM!MTB
AhnLab-V3	Trojan/Win32.MalPe.R330043
Acronis	suspicious
ALYac	Trojan.GenericKD.33567430
Cylance	Unsafe
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HCGS
Rising	Backdoor.Androm!8.113 (CLOUD)
Yandex	Trojan.Kryptik!pZGJCdn1Jn0
Ikarus	Trojan.Win32.Ranumbot
Fortinet	W32/RyPack.A!tr
Webroot	W32.Malware.Gen
AVG	Win32:CoinminerX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Generic/Trojan.160