Categories: Malware

Win32/Kryptik.HJOS information

The Win32/Kryptik.HJOS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HJOS virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (3 unique times)
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
Performs some HTTP requests
Unconventionial language used in binary resources: Tatar
The binary likely contains encrypted or compressed data.
Checks for the presence of known windows from debuggers and forensic tools
Installs itself for autorun at Windows startup
Attempts to identify installed AV products by installation directory
Checks the CPU name from registry, possibly for anti-virtualization
Detects VirtualBox through the presence of a registry key

Related domains:

iplogger.org

paperships.top

ip-api.com

How to determine Win32/Kryptik.HJOS?


File Info:
crc32: 80896344md5: c510b5a0ace3f83ca207dd96dcc676d0name: C510B5A0ACE3F83CA207DD96DCC676D0.mlwsha1: e877c5c8aa0f221b917ea140c6d33bddd86e406esha256: 453debcca834d384581837da8253ac5f4e2eaf7fc641407081d1e7cf57bc4266sha512: c9872eb23bde88f84bc6d135f5d58a8e01d4f3f6c71029d019eceb145e40b8b05a597dfde413d574440bd7cb5e2f96261f470d60fd73ad47453e179a62f49f2fssdeep: 12288:eNa2/Ngzo0F/nYXi+7sr3LKaGeN9wzA7pIhCJvoQ0VKP/Rgf/euh3t2Fw0FCkAF:enV8o4PYXil3maGk6A7Gclx0e/ub3tqtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
InternalName: calinilimodumator.exeFileVersions: 7.0.0.23LegalCopyrights: VsekdagProductVersions: 67.0.20.45Translation: 0x0409 0x135c

Win32/Kryptik.HJOS also known as:

Bkav	W32.AIDetectGBM.malware.01
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.45765842
Qihoo-360	Win32/Trojan.Generic.HwoCcjsA
McAfee	RDN/RedLineStealer
Cylance	Unsafe
AegisLab	Trojan.Win32.Blocker.mDYp
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.45765842
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D2BA54D2
Cyren	W32/Trojan.FWF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
Alibaba	Trojan:Win32/Generic.fe0cd247
Rising	Malware.Heuristic!ET#88% (RDMK:cmRtazoASFFwQXRHj8QTctdl3YDr)
Ad-Aware	Trojan.GenericKD.45765842
Sophos	ML/PE-A
F-Secure	Trojan.TR/AD.AHKInfoSteal.ufzle
DrWeb	Trojan.PWS.Siggen2.61685
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
FireEye	Generic.mg.c510b5a0ace3f83c
Emsisoft	Trojan.GenericKD.45765842 (B)
SentinelOne	Static AI – Malicious PE
Webroot	W32.Trojan.Gen
Avira	TR/AD.AHKInfoSteal.ufzle
MAX	malware (ai score=89)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.D4!ml
ViRobot	Trojan.Win32.Z.Agent.706560.P
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
GData	Trojan.GenericKD.45765842
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Tofsee.R367511
Acronis	suspicious
ALYac	Spyware.Infostealer.RedLine
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Kryptik.HJOS
Ikarus	Trojan.Crypt
Fortinet	W32/GenKryptik.FCBA!tr
AVG	Win32:DropperX-gen [Drp]
Cybereason	malicious.8aa0f2
Avast	Win32:DropperX-gen [Drp]