Categories: Malware

Win32/Kryptik.HFRR (file analysis)

The Win32/Kryptik.HFRR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Kryptik.HFRR virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Latvian
  • The binary likely contains encrypted or compressed data.
  • Attempts to modify proxy settings
  • Collects information to fingerprint the system
  • Anomalous binary characteristics

Related domains:

gomisacar.com

How to determine Win32/Kryptik.HFRR?


File Info:

crc32: AB88081Bmd5: b53c97556e389f3bb7d37d600b1ad77cname: 5.exesha1: a36dd5f5045c0663f38a2d1a6bb9786c295b03e5sha256: 1dd4733ec9e461c65cc40e8447f98775d82973671fe146997a716e2c4e6f32d1sha512: bdbfaf688067101a5fa0b527e7358aa4ce01413702a848830489e838097f92446b6b0b4edf1b9acb9f93ff0641ec35753102ee1cbc591224a8210a2b7cb1df51ssdeep: 6144:nhGernrNxoKd9uXKHMsAGERw0Q9dys5qSj2ISxz/TJ+1zbmjYT3jNh+NClJT8zV:nwerrfDHjE6vwM2/TEwcT3JhzJwzFzTtype: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

FileVersiones: 1.0.6.1Copyright: Copyright (C) 2021, rotoTranslations: 0x0182 0x0b9f

Win32/Kryptik.HFRR also known as:

Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34409987
FireEye Generic.mg.b53c97556e389f3b
CAT-QuickHeal Trojan.Wacatac
Qihoo-360 Win32/Trojan.f20
ALYac Trojan.GenericKD.34409987
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.2437338
Sangfor Malware
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.GenericKD.34409987
K7GW Trojan ( 00569d2c1 )
K7AntiVirus Trojan ( 00569d2c1 )
TrendMicro TROJ_GEN.R03FC0PHO20
BitDefenderTheta Gen:NN.ZexaF.34216.GqW@aS3q!gcc
Cyren W32/Trojan.BQFK-3405
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
ClamAV Win.Dropper.Tofsee-9478942-0
Kaspersky Trojan.Win32.Chapak.euym
Alibaba Trojan:Win32/Chapak.2eacc689
NANO-Antivirus Trojan.Win32.Chapak.hssykz
ViRobot Trojan.Win32.Z.Crypt.526848.A
AegisLab Trojan.Win32.Malicious.4!c
Rising Trojan.Kryptik!1.CB14 (CLASSIC)
Ad-Aware Trojan.GenericKD.34409987
Comodo .UnclassifiedMalware@0
F-Secure Trojan.TR/Crypt.Agent.bqugc
DrWeb Trojan.Siggen10.8563
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-S
Sophos Mal/Generic-S
SentinelOne DFI – Suspicious PE
Jiangmin Trojan.Chapak.lak
Webroot W32.Malware.Gen
Avira TR/Crypt.Agent.bqugc
Antiy-AVL Trojan/Win32.Chapak
Microsoft Trojan:Win32/Skeeyah.A!rfn
Arcabit Trojan.Generic.D20D0E03
AhnLab-V3 Malware/Win32.Generic.C4185429
ZoneAlarm Trojan.Win32.Chapak.euym
GData Trojan.GenericKD.34409987
Cynet Malicious (score: 100)
ESET-NOD32 a variant of Win32/Kryptik.HFRR
Acronis suspicious
McAfee Packed-GBE!B53C97556E38
VBA32 Trojan.Chapak
Malwarebytes Trojan.MalPack.GS
TrendMicro-HouseCall TROJ_GEN.R03FC0PHO20
Tencent Win32.Trojan.Chapak.Pdma
MAX malware (ai score=100)
Fortinet W32/Ursnif.BCED!tr
AVG Win32:MalwareX-gen [Trj]
Cybereason malicious.5045c0
Panda Trj/GdSda.A
MaxSecure Trojan.Malware.105956328.susgen

How to remove Win32/Kryptik.HFRR?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Malware.AI.2099319323 information

The Malware.AI.2099319323 is considered dangerous by lots of security experts. When this infection is active,…

3 mins ago

Backdoor.GenericFC.S20328115 removal guide

The Backdoor.GenericFC.S20328115 is considered dangerous by lots of security experts. When this infection is active,…

8 mins ago

How to remove “PWS:Win32/Lmir.JJ”?

The PWS:Win32/Lmir.JJ is considered dangerous by lots of security experts. When this infection is active,…

43 mins ago

Malware.AI.263066098 malicious file

The Malware.AI.263066098 is considered dangerous by lots of security experts. When this infection is active,…

58 mins ago

Buzus.8 removal guide

The Buzus.8 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Babar.438741 removal instruction

The Babar.438741 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago