Win32/Kryptik.HIKP removal instruction

The Win32/Kryptik.HIKP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HIKP virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (3 unique times)
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
Performs some HTTP requests
Unconventionial language used in binary resources: Slovenian
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Checks for the presence of known windows from debuggers and forensic tools
Installs itself for autorun at Windows startup
Attempts to identify installed AV products by installation directory
Checks the CPU name from registry, possibly for anti-virtualization
Detects VirtualBox through the presence of a registry key
Anomalous binary characteristics

Related domains:

iplogger.org

leatherbond.top

ip-api.com

How to determine Win32/Kryptik.HIKP?


File Info:
crc32: 89094E9D
md5: 96fd25d614d52e3d0750471f1ec23165
name: 96FD25D614D52E3D0750471F1EC23165.mlw
sha1: 5bdee179974ae831436f76e59f28e34afa96c5ad
sha256: 17232397f13b120797a8de3e1f20595288523169a493266b72041bfeef91dd5d
sha512: 91a1bef2fc2e8467b87401397a8967ff18fddd25b025ab18790ee65311d9e591006b0036307f14442787ac99ad8c9ca774d97c4e14bdbeb9862b4240e59bdfdd
ssdeep: 12288:wbDqTHTELlTLy0Um+Ax9bLF2BYMGQ59q8EterjBOX77tf3YYxzL4W8BDUg3clzB:qDqTH4LlGBAbLUua5FEtef2d/zxzs9u
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
InternalSurname: rebound.exe
Product: 1.7.6
FileVersions: 1.0.5.4
LegalCo: Copyri (C) 2019, parritions
Translation: 0x5539 0x00fa

Win32/Kryptik.HIKP also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.Carberp.2635
MicroWorld-eScan	Trojan.GenericKD.45156401
FireEye	Generic.mg.96fd25d614d52e3d
ALYac	Trojan.GenericKD.45156401
Malwarebytes	Trojan.MalPack.GS
Sangfor	Malware
K7AntiVirus	Trojan ( 0057541b1 )
BitDefender	Trojan.GenericKD.45156401
K7GW	Trojan ( 0057541b1 )
Cybereason	malicious.9974ae
BitDefenderTheta	Gen:NN.ZexaF.34700.QmGfaK13xAkc
Cyren	W32/Trojan.EKYI-3428
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	Trojan-Spy.Win32.Stealer.vmf
Alibaba	TrojanSpy:Win32/Stealer.bb67d099
ViRobot	Trojan.Win32.Z.Kryptik.697856.BG
Ad-Aware	Trojan.GenericKD.45156401
Sophos	Mal/Generic-S
Comodo	Malware@#2l3145xl5vvby
McAfee-GW-Edition	BehavesLike.Win32.PWSBanker.jc
Emsisoft	Trojan.Crypt (A)
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanSpy.Stealer.dki
Webroot	W32.Trojan.Gen
Avira	TR/AD.AHKInfoSteal.gzsbj
Kingsoft	Win32.Troj.Stealer.v.(kcloud)
Microsoft	Trojan:Win32/Azorult.FW!MTB
Gridinsoft	Trojan.Win32.Kryptik.oa
Arcabit	Trojan.Generic.D2B10831
ZoneAlarm	Trojan-Spy.Win32.Stealer.vmf
GData	Trojan.GenericKD.45156401
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.RL_Kryptik.R360326
McAfee	RDN/RedLineStealer
VBA32	BScope.Trojan.Injuke
Cylance	Unsafe
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HIKP
Tencent	Win32.Trojan-spy.Stealer.Hwmv
Ikarus	Trojan.Win32.Crypt
Fortinet	W32/Kryptik.HFSR!tr
AVG	FileRepMalware
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Generic/HEUR/QVM11.1.27D4.Malware.Gen

How to remove Win32/Kryptik.HIKP?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.HIKP removal instruction