Win32/Kryptik.HDDG (file analysis)

The Win32/Kryptik.HDDG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HDDG virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Attempts to connect to a dead IP:Port (3 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Spanish (Guatemala)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Collects and encrypts information about the computer likely to send to C2 server

How to determine Win32/Kryptik.HDDG?

File Info:
name: D45768CEAE6CFDD8D419.mlw
path: /opt/CAPEv2/storage/binaries/2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc
crc32: 98A73BCF
md5: d45768ceae6cfdd8d41904340c72517a
sha1: 12062eca4bb9b412b8af3873d6224f5909153aaf
sha256: 2a67f7b5c5a1fae80726c98335f2be0533ab9a10ea6c26615ce67229fd3043bc
sha512: d2b91415aa026adebb126612a32cf6318af4289672d848016e19a301e40f8d28eb9dc477762270c098e936f10c2e07b1c31a497aeef5ecad7f338ee2cf1b86b5
ssdeep: 24576:xv3jPx6Xmq+mcDj3TPY/RoE7BUf3boOlAUkvRtBz:hjUXADYZoEFY3boOlDkHB
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T16125230276E548B3FAC2EDF040B1CBD71B3CB0352652545F7BA4E5BA2668BE047E534A
sha3_384: 6b44be5a8d66090afe37ade90a5165e2450be1215193deb3ecb6f072bbb39c3735ed27eec8e2ec67e72ffb178442cea2
ep_bytes: e8931a0000e978feffff8bff558bec81
timestamp: 2018-11-12 11:15:57

Version Info:
FileVersion: 1.0.5.4
InternalName: fbadbess.exu
LegalCopyright: Copyright (C) 2019, jwfmvlj
ProductVersion: 1.7.6
Translation: 0x0841 0x04c4

Win32/Kryptik.HDDG also known as:

How to remove Win32/Kryptik.HDDG?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.