Win32/Kryptik.HHEH removal guide

The Win32/Kryptik.HHEH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HHEH virus can do?

Executable code extraction
Compression (or decompression)
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
At least one IP Address, Domain, or File Name was found in a crypto call
Starts servers listening on 127.0.0.1:27783
A process created a hidden window
Unconventionial language used in binary resources: Spanish
The binary likely contains encrypted or compressed data.
A scripting utility was executed
Steals private information from local Internet browsers
Installs itself for autorun at Windows startup
Attempts to execute a powershell command with suspicious parameter/s
Collects information about installed applications
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Kryptik.HHEH?


File Info:
crc32: 12A524DE
md5: ea33daf97ba97bceee2e4100afe2b3c2
name: EA33DAF97BA97BCEEE2E4100AFE2B3C2.mlw
sha1: cce1b27418544d8ef2b0121a3eaee74347aab2fd
sha256: effc855411ac05167e4e3cccaa6cf7570ec8a3818cbf41be26190e85fa7c4247
sha512: b67ec2cf49f1385301ee3260ea627c91b782e19f810f113cf9b142c623437d6aba8d59768a30afb4b25668b400ec790d75f3cf7b4ff5322e4273e26a97f2c158
ssdeep: 98304:gv1+eyuZHIpOUIjYKDgK+Jnd2AEuPpLlmur:c1+wHIEY/K+JbLAur
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
InternalName: writeawtsy.ets
FileVers: 1.22.381
Copyright: Copyrighz (C) 2020, gubkabo
TranslationUsa: 0x0421 0x0cd7

Win32/Kryptik.HHEH also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.35064329
FireEye	Generic.mg.ea33daf97ba97bce
McAfee	Packed-GCZ!EA33DAF97BA9
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0056fc4c1 )
BitDefender	Trojan.GenericKD.35064329
K7GW	Trojan ( 0056fc4c1 )
Cybereason	malicious.418544
Cyren	W32/Kryptik.CIT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Trojan:Win32/Kryptik.d26f4943
ViRobot	Trojan.Win32.Z.Malpack.4931590
Rising	Malware.Obscure/Heur!1.9E03 (CLASSIC)
Ad-Aware	Trojan.GenericKD.35064329
Sophos	Mal/Generic-S
DrWeb	Trojan.Siggen10.45368
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.rc
Emsisoft	Trojan.GenericKD.35064329 (B)
SentinelOne	DFI – Suspicious PE
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/Azorult.FW!MTB
Gridinsoft	Trojan.Win32.Packed.oa
Arcabit	Trojan.Generic.D2170A09
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Win32.Trojan-Stealer.Petef.64KMTS
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Glupteba.R354659
Acronis	suspicious
ALYac	Trojan.GenericKD.35064329
VBA32	BScope.Exploit.Shellcode
Malwarebytes	Trojan.MalPack.GS
ESET-NOD32	a variant of Win32/Kryptik.HHEH
Ikarus	Trojan.Win32.Glupteba
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.EVRY!tr
AVG	Win32:DropperX-gen [Drp]
Avast	Win32:DropperX-gen [Drp]
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Generic/HEUR/QVM10.2.02D2.Malware.Gen

How to remove Win32/Kryptik.HHEH?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.HHEH removal guide