Win32/Kryptik.HGTK removal guide

Malware Removal

The Win32/Kryptik.HGTK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Win32/Kryptik.HGTK virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process created a hidden window
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Steals private information from local Internet browsers
  • Collects information about installed applications
  • Checks the CPU name from registry, possibly for anti-virtualization
  • Attempts to modify proxy settings
  • Attempts to access Bitcoin/ALTCoin wallets
  • Harvests credentials from local FTP client softwares
  • Harvests information related to installed instant messenger clients
  • Harvests information related to installed mail clients
  • Collects information to fingerprint the system
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Win32/Kryptik.HGTK?


File Info:

crc32: 2996FCF8
md5: c807edddfb5aa9971df3af55318fbb86
name: upload_file
sha1: 5c3452dc077a27752ba2590291e7d877858924e7
sha256: 39a2033a8ecbbf30857ce622d6366e363dcd9679814899b46dcabf99cf5c5fde
sha512: b22f4b44967e40ac0261b091b81b4bd3b0617f5ab865099935c46139814fad57f1529460f459702fd19c0fd68cd7bb0fedfb1557a43afad569ba9fe8b0dc9da1
ssdeep: 3072:WYULOOEaSOh3nAV0KRv6SO7JTv+d0y9OpUq6XOR0DlV:WYULOOphIbvgNTv+d05pYDJ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

FileV: 1.0.2.27
Translations: 0x0218 0x0167

Win32/Kryptik.HGTK also known as:

BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
FireEyeGeneric.mg.c807edddfb5aa997
McAfeeArtemis!C807EDDDFB5A
CylanceUnsafe
SangforMalware
Cybereasonmalicious.c077a2
CyrenW32/Kryptik.CAF.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
KasperskyUDS:DangerousObject.Multi.Generic
InvinceaGeneric ML PUA (PUA)
McAfee-GW-EditionBehavesLike.Win32.Emotet.cc
WebrootW32.Trojan.Gen
MicrosoftPWS:Win32/Stimilina.E!bit
SUPERAntiSpywareTrojan.Agent/Gen-Kryptik
ZoneAlarmUDS:DangerousObject.Multi.Generic
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.Generic.C4206524
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.34570.kqW@aGX7jLu
VBA32BScope.Exploit.ShellCode
MalwarebytesTrojan.MalPack.GS
PandaTrj/Genetic.gen
ESET-NOD32a variant of Win32/Kryptik.HGTK
RisingTrojan.Kryptik!1.CBE0 (CLASSIC)
SentinelOneDFI – Malicious PE
AVGFileRepMalware
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_90% (D)
Qihoo-360Generic/HEUR/QVM10.2.9A15.Malware.Gen

How to remove Win32/Kryptik.HGTK?

Win32/Kryptik.HGTK removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment