Malware

About “Win32/Kryptik.HEMI” infection

Malware Removal

The Win32/Kryptik.HEMI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Kryptik.HEMI virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • Unconventionial language used in binary resources: Spanish (El Salvador)
  • The binary likely contains encrypted or compressed data.
  • Attempts to identify installed AV products by installation directory
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Anomalous binary characteristics

Related domains:

iplogger.org

How to determine Win32/Kryptik.HEMI?


File Info:

crc32: A829E4CA
md5: 8f80f9456b640137bf39bd51c18b4690
name: infostat.exe
sha1: 7f62cd2c4eb16499ba37a9c007bd33a4910932fa
sha256: 0d204a3dcd80cbbf3063bfa130f163a4281c56bab9a5017faf6307025b5c829d
sha512: 57b4d77eb2c64524161aab7a663d6c9412319bd50beedbe493e74cf8c74ee0f9816505eb29905872f28cc2f9688378777230e5bcf29f72c3aa39821b758e217b
ssdeep: 12288:tSLXcwT7VudW2m/n1emwnht+Ug69d7ADhqdLV89D:t2JVGlmnOTnxV8d
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translations: 0x0292 0x0315

Win32/Kryptik.HEMI also known as:

BkavHW32.Packed.
MicroWorld-eScanTrojan.GenericKD.34084760
FireEyeGeneric.mg.8f80f9456b640137
CAT-QuickHealRansom.Stop.MP4
ALYacTrojan.GenericKD.34084760
SangforMalware
K7AntiVirusTrojan ( 005643101 )
BitDefenderTrojan.GenericKD.34084760
K7GWTrojan ( 005643101 )
Cybereasonmalicious.c4eb16
TrendMicroTrojan.Win32.WACATAC.THFBHBO
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HEMI
APEXMalicious
AvastWin32:CoinminerX-gen [Trj]
GDataTrojan.GenericKD.34084760
AegisLabTrojan.Win32.Malicious.4!c
Ad-AwareTrojan.GenericKD.34084760
EmsisoftTrojan.GenericKD.34084760 (B)
F-SecureTrojan.TR/AD.AHKInfoSteal.biwgu
DrWebTrojan.Siggen9.56113
Invinceaheuristic
SophosMal/Generic-S
SentinelOneDFI – Malicious PE
AviraTR/AD.AHKInfoSteal.biwgu
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D2081798
AhnLab-V3PUP/Win32.Agent.R341806
MicrosoftTrojan:Win32/Wacatac.C!ml
CynetMalicious (score: 100)
Acronissuspicious
McAfeeGenericRXAA-AA!8F80F9456B64
MAXmalware (ai score=83)
MalwarebytesTrojan.MalPack.GS
TrendMicro-HouseCallTrojan.Win32.WACATAC.THFBHBO
RisingTrojan.Kryptik!8.8 (CLOUD)
IkarusTrojan-Downloader.Win32.Zurgop
eGambitUnsafe.AI_Score_81%
FortinetPossibleThreat.PALLAS.H
AVGWin32:CoinminerX-gen [Trj]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Win32/Kryptik.HEMI?

Win32/Kryptik.HEMI removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment