Win32/Kryptik.HGSQ (file analysis)

The Win32/Kryptik.HGSQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HGSQ virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Mimics the system’s user agent string for its own requests
Possible date expiration check, exits too soon after checking local time
A process attempted to delay the analysis task.
A named pipe was used for inter-process communication
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
A process created a hidden window
Performs some HTTP requests
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
A system process is generating network traffic likely as a result of process injection
Installs itself for autorun at Windows startup
Checks the CPU name from registry, possibly for anti-virtualization
Attempts to modify proxy settings
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

www.ip-adress.com

How to determine Win32/Kryptik.HGSQ?


File Info:
crc32: 8E6AF94B
md5: b7d6131360c9d56ac6462188a0070cf8
name: kv.gif
sha1: 39f73672cd70469aec5a0404e28e3b80859a693a
sha256: 7bd95ebd225b01f41b38412d88230f31a33c666152c39d4fa24233d5898ec24b
sha512: fb2b17013d985564855570a6dc0f6aa6a55d252ae3dcdef774b7a501afce30aa9d7f828b39db646528eed04b5e93d0a76946b24e234a9020a4f1e02b74f5d1ba
ssdeep: 6144:ikCfYYMARvpDuauTxyRRzB/poIH3HhHNthRHt1H5HP7fetSyc2Sgp:tCfYYMwvIJiRt/pj+cTgp
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (c) 1999-2011 Igor Pavlov
InternalName: 7z
FileVersion: 9.23 alpha
CompanyName: Igor Pavlov
ProductName: 7-Zip
ProductVersion: 9.23 alpha
FileDescription: 7-Zip Console
OriginalFilename: 7z.exe
Translation: 0x0409 0x04b0

Win32/Kryptik.HGSQ also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.b7d6131360c9d56a
Qihoo-360	HEUR/QVM20.1.9377.Malware.Gen
McAfee	W32/PinkSbot-HC!B7D6131360C9
Cylance	Unsafe
Sangfor	Malware
Cybereason	malicious.2cd704
Cyren	W32/Qbot.AA.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Rising	Malware.Undefined!8.C (TFE:2:szhKj0LokFE)
DrWeb	Trojan.QakBot.11
Invincea	Generic ML PUA (PUA)
McAfee-GW-Edition	W32/PinkSbot-HC!B7D6131360C9
Ikarus	Trojan-Spy.Agent
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Qakbot.AR!MTB
GData	Win32.Packed.QBot.A
Acronis	suspicious
VBA32	BScope.TrojanRansom.Shade
Malwarebytes	Trojan.Qbot
ESET-NOD32	a variant of Win32/Kryptik.HGSQ
SentinelOne	DFI – Malicious PE
eGambit	PE.Heur.InvalidSig
Fortinet	W32/GenericKDZ.6939!tr
BitDefenderTheta	Gen:NN.ZexaF.34566.Gt1@a0OeEfci

How to remove Win32/Kryptik.HGSQ?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.HGSQ (file analysis)