Categories: Malware

Win32/Kryptik.HCLE malicious file

The Win32/Kryptik.HCLE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HCLE virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Starts servers listening on 127.0.0.1:49485
Reads data out of its own binary image
Performs some HTTP requests
Installs Tor on the infected machine
Installs itself for autorun at Windows startup
Collects information about installed applications
Creates a hidden or system file
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

edgedl.me.gvt1.com

How to determine Win32/Kryptik.HCLE?


File Info:
crc32: 5AADC171md5: 14502fbeec26eb182fbe8dbc0d4caad2name: 14502FBEEC26EB182FBE8DBC0D4CAAD2.mlwsha1: 67c73157daa346c9c5dc89014ece4730abc078acsha256: d132fb4087da26aeeb5fee05c401bd1dd52d49c9192e90ef366592c9713e625asha512: 4da9f123beb519bbd4b75399ea519d9df529285193b99e004d8ed3a7f6cb2cbe4d691c266f4b58037e7bc8a35951e81264f3da7d5bff770125bfbd94fd51a147ssdeep: 24576:r6Hur/I2SLperNAQijFHmuBDxzDUwgdz8kOZNF3:ryuI2SlerNAQgFHmyiwgKvdtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Win32/Kryptik.HCLE also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0056708b1 )
Lionic	Hacktool.Win32.Krap.lKMc
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.858
Cynet	Malicious (score: 100)
ALYac	Trojan.Ransom.Shade
Cylance	Unsafe
Zillya	Trojan.Shade.Win32.1045
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Ransom:Win32/Shade.59785753
K7GW	Trojan ( 0054830c1 )
Cybereason	malicious.eec26e
Cyren	W32/S-b4759f84!Eldorado
Symantec	Downloader
ESET-NOD32	a variant of Win32/Kryptik.HCLE
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Heur.Mint.Jamg.1
NANO-Antivirus	Trojan.Win32.Encoder.fnhwdn
ViRobot	Trojan.Win32.S.Ransom.1441992
MicroWorld-eScan	Gen:Heur.Mint.Jamg.1
Tencent	Malware.Win32.Gencirc.10b5889e
Ad-Aware	Gen:Heur.Mint.Jamg.1
Sophos	Mal/Generic-R + Mal/Emotet-Q
Comodo	TrojWare.Win32.Banker.XE@83s6vi
BitDefenderTheta	Gen:NN.ZexaF.34170.ynX@aSbB87g
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom.Win32.SHADE.THBBHAI
McAfee-GW-Edition	Trojan-FQRJ!14502FBEEC26
FireEye	Generic.mg.14502fbeec26eb18
Emsisoft	Gen:Heur.Mint.Jamg.1 (B)
Jiangmin	Trojan.Shade.qr
Avira	HEUR/AGEN.1133621
eGambit	PE.Heur.InvalidSig
Antiy-AVL	Trojan/Generic.ASMalwS.2AA5A78
Microsoft	Ransom:Win32/CerberCrypt.PB!MTB
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Heur.Mint.Jamg.1
AhnLab-V3	Trojan/Win32.RansomCrypt.C3032815
McAfee	Trojan-FQRJ!14502FBEEC26
MAX	malware (ai score=100)
VBA32	BScope.Malware-Cryptor.Winlock.2014
Malwarebytes	Ransom.Troldesh
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Ransom.Win32.SHADE.THBBHAI
Rising	Trojan.Generic@ML.97 (RDML:/BM7lnrYAFNIK61GveWj3g)
Yandex	Trojan.GenAsa!eJY2ueADONA
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.74151219.susgen
Fortinet	W32/GenKryptik.BGST!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml