Win32/Kryptik.HIKA (file analysis)

The Win32/Kryptik.HIKA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HIKA virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
Performs some HTTP requests
Unconventionial binary language: Russian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

telete.in

apps.identrust.com

tripsafe.fun

How to determine Win32/Kryptik.HIKA?


File Info:
crc32: BCEF7D70
md5: 2c8316535580b835c1501608a0c54d27
name: 2C8316535580B835C1501608A0C54D27.mlw
sha1: db2147ac65e44f7ac4461a45e319bcbede9209b6
sha256: 936cbd7a8071272045f11265e258264cf6638791d133352399860024c763fd8d
sha512: fec89b31f5fbf18baa1afcba19e4d450ab6fb199fdbf1ed028ce230dc23e390a8c3b48550a60db05aa8e37f30e83c7dfe7fcf86d5db95d9a62993f737200af28
ssdeep: 12288:x8lUUgSYHN5Rji3NRJyCBVZfsO5wzOt00MK6Zh6VaCZ6TKY0Zb:x88SkDRAJVJlwatAK6ZhAb
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
InternalSurname: rebood.exe
Product: 1.7.6
FileVersions: 1.0.5.4
LegalCo: Copyri (C) 2019, patroc
Translation: 0x0419 0x0103

Win32/Kryptik.HIKA also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.72179
FireEye	Generic.mg.2c8316535580b835
Qihoo-360	HEUR/QVM11.1.2318.Malware.Gen
Cylance	Unsafe
Sangfor	Malware
BitDefender	Trojan.GenericKDZ.72179
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKDZ.72179
Emsisoft	Trojan.GenericKDZ.72179 (B)
DrWeb	Trojan.Siggen11.56374
McAfee-GW-Edition	BehavesLike.Win32.Trojan.hc
Sophos	ML/PE-A
Ikarus	Trojan-Spy.Win32.SpyEyes
Microsoft	Trojan:Win32/Glupteba!ml
Arcabit	Trojan.Generic.D119F3
GData	Trojan.GenericKDZ.72179
Cynet	Malicious (score: 100)
McAfee	GenericRXAA-AA!2C8316535580
MAX	malware (ai score=83)
VBA32	BScope.Backdoor.Agent
Malwarebytes	Trojan.MalPack.GS
ESET-NOD32	a variant of Win32/Kryptik.HIKA
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_83%
Fortinet	W32/Kryptik.HFSR!tr
BitDefenderTheta	Gen:NN.ZexaF.34700.FmGfauFwCZp
AVG	Win32:DropperX-gen [Drp]
Avast	Win32:DropperX-gen [Drp]

How to remove Win32/Kryptik.HIKA?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.HIKA (file analysis)