Categories: Malware

Win32/Kryptik.HIKA (file analysis)

The Win32/Kryptik.HIKA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HIKA virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
Performs some HTTP requests
Unconventionial binary language: Russian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

telete.in

apps.identrust.com

tripsafe.fun

How to determine Win32/Kryptik.HIKA?


File Info:
crc32: BCEF7D70md5: 2c8316535580b835c1501608a0c54d27name: 2C8316535580B835C1501608A0C54D27.mlwsha1: db2147ac65e44f7ac4461a45e319bcbede9209b6sha256: 936cbd7a8071272045f11265e258264cf6638791d133352399860024c763fd8dsha512: fec89b31f5fbf18baa1afcba19e4d450ab6fb199fdbf1ed028ce230dc23e390a8c3b48550a60db05aa8e37f30e83c7dfe7fcf86d5db95d9a62993f737200af28ssdeep: 12288:x8lUUgSYHN5Rji3NRJyCBVZfsO5wzOt00MK6Zh6VaCZ6TKY0Zb:x88SkDRAJVJlwatAK6ZhAbtype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
InternalSurname: rebood.exeProduct: 1.7.6FileVersions: 1.0.5.4LegalCo: Copyri (C) 2019, patrocTranslation: 0x0419 0x0103

Win32/Kryptik.HIKA also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.72179
FireEye	Generic.mg.2c8316535580b835
Qihoo-360	HEUR/QVM11.1.2318.Malware.Gen
Cylance	Unsafe
Sangfor	Malware
BitDefender	Trojan.GenericKDZ.72179
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKDZ.72179
Emsisoft	Trojan.GenericKDZ.72179 (B)
DrWeb	Trojan.Siggen11.56374
McAfee-GW-Edition	BehavesLike.Win32.Trojan.hc
Sophos	ML/PE-A
Ikarus	Trojan-Spy.Win32.SpyEyes
Microsoft	Trojan:Win32/Glupteba!ml
Arcabit	Trojan.Generic.D119F3
GData	Trojan.GenericKDZ.72179
Cynet	Malicious (score: 100)
McAfee	GenericRXAA-AA!2C8316535580
MAX	malware (ai score=83)
VBA32	BScope.Backdoor.Agent
Malwarebytes	Trojan.MalPack.GS
ESET-NOD32	a variant of Win32/Kryptik.HIKA
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_83%
Fortinet	W32/Kryptik.HFSR!tr
BitDefenderTheta	Gen:NN.ZexaF.34700.FmGfauFwCZp
AVG	Win32:DropperX-gen [Drp]
Avast	Win32:DropperX-gen [Drp]