Categories: Malware

Should I remove “Win32/Kryptik.HFOL”?

The Win32/Kryptik.HFOL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HFOL virus can do?

Executable code extraction
Creates RWX memory
Attempts to connect to a dead IP:Port (7 unique times)
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
Performs some HTTP requests
Unconventionial language used in binary resources: Russian
Uses Windows utilities for basic functionality
Network activity contains more than one unique useragent.
Creates a hidden or system file
Attempts to modify proxy settings
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

kitemimbe.com

iplogger.org

www.bing.com

apps.identrust.com

isrg.trustid.ocsp.identrust.com

ocsp.int-x3.letsencrypt.org

How to determine Win32/Kryptik.HFOL?


File Info:
crc32: 72607CAEmd5: 2f8ab6db4d9f6cf863662aaef36705d6name: upload_filesha1: a09c1904669b14ce0975ab9621ad5c8f5b7dee28sha256: c617d81701063424eea07d4a25f89323a7dbad0d68578c6d9eeaff8436d4ce17sha512: fed3a22781ab452a839842c553262f42837c96b4cdd67baa0d32065fe29da230517fb8e795150ddb4df1b8d3dd6c73a25656eb970fdd37c98a83bb47f8f3c208ssdeep: 12288:pANwRo+mv8QD4+0V16efdxFDBj8BkPDeFHN2UJjVX/ZntfwqdEGImbNaQSIm:pAT8QE+k/lxvj8ceFprZdPdjImxa/7type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: wotsuper                                                                                            FileDescription: wotsuper 2.1 Installation                                   FileVersion: 2.1                 Comments: CompanyName: wotsuper                                                    Translation: 0x0409 0x04e4

Win32/Kryptik.HFOL also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.43685669
FireEye	Generic.mg.2f8ab6db4d9f6cf8
CAT-QuickHeal	Trojan.Multi
McAfee	Artemis!2F8AB6DB4D9F
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0056c87f1 )
BitDefender	Trojan.GenericKD.43685669
K7GW	Trojan ( 0056c87f1 )
CrowdStrike	win/malicious_confidence_60% (W)
Invincea	heuristic
Cyren	W32/Trojan.EJOW-3739
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
ClamAV	Win.Dropper.Vidar-9182565-0
Kaspersky	Trojan.Win32.Chapak.eunq
Alibaba	Trojan:Win32/Chapak.bcb20089
NANO-Antivirus	Trojan.Win32.Chapak.hslpxr
AegisLab	Trojan.Multi.Generic.4!c
Rising	Trojan.Kryptik!1.CB19 (CLASSIC)
Ad-Aware	Trojan.GenericKD.43685669
F-Secure	Trojan.TR/AD.VidarStealer.KZ
DrWeb	Trojan.Siggen10.5628
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R03BC0WHJ20
Sophos	Mal/Generic-S
Ikarus	Trojan-PSW.Agent
MaxSecure	Trojan-Ransom.Win32.Crypmod.zfq
Avira	TR/AD.VidarStealer.KZ
MAX	malware (ai score=99)
Antiy-AVL	Trojan/Win32.Chapak
Microsoft	Trojan:Win32/Ymacco.AAC6
Arcabit	Trojan.Generic.D29A9725
SUPERAntiSpyware	Trojan.Agent/Gen-Downloader
ZoneAlarm	Trojan.Win32.Chapak.eunq
GData	Trojan.GenericKD.43685669
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C3733562
BitDefenderTheta	Gen:NN.ZexaF.34196.FqW@aWpLKfgG
ALYac	Trojan.GenericKD.43685669
VBA32	Malware-Cryptor.Limpopo
Malwarebytes	Trojan.Downloader
Panda	Trj/CI.A
ESET-NOD32	a variant of Win32/Kryptik.HFOL
TrendMicro-HouseCall	TROJ_GEN.R03BC0WHJ20
Tencent	Win32.Trojan.Chapak.Huqc
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Agent.OKD!tr
Webroot	W32.Trojan.Gen
AVG	Win32:DropperX-gen [Drp]
Cybereason	malicious.4669b1
Paloalto	generic.ml
Qihoo-360	Generic/HEUR/QVM05.1.5240.Malware.Gen