Malware

Win32/Kryptik.HJTB malicious file

Malware Removal

The Win32/Kryptik.HJTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Kryptik.HJTB virus can do?

  • Executable code extraction
  • At least one process apparently crashed during execution
  • Creates RWX memory
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • Unconventionial binary language: Persian (Iran)
  • Unconventionial language used in binary resources: Slovak
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • A process attempted to delay the analysis task by a long amount of time.
  • Behavior consistent with a dropper attempting to download the next stage.
  • A process sent information about the computer to a remote location.
  • Attempts to identify installed AV products by installation directory
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Harvests credentials from local FTP client softwares
  • Harvests information related to installed instant messenger clients
  • Harvests information related to installed mail clients
  • Anomalous binary characteristics

How to determine Win32/Kryptik.HJTB?


File Info:

crc32: E58EFA59
md5: 969d78331a68abee30d7515c36143d11
name: 969D78331A68ABEE30D7515C36143D11.mlw
sha1: ab91d108641b5bb7bc1f5b0dc817f353ed0afd0a
sha256: 87dc8fe82269f898debc1ccccb20d8bb8e1f0d962c34e9647d1de378dff70171
sha512: 54380c5ba6fdbaa6870020fd4fca7212817e8761ecda8e566a9c8efd97f71d2ef9d66e7abe51a861679cfc185349827d5293eeed8eb653165a875751b2a155e4
ssdeep: 6144:+e5KdPXSlTmMRWal6ee+BLb5ibqvWjp2YE8XvlGZmbBHa8qp2VI0fg:+e5YPXtMcreeo1iUAoY9XwII8WNkg
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

InternalName: calimalimodunator.exe
FileVersions: 7.0.0.23
LegalCopyrights: Vsekdag
ProductVersions: 67.0.20.45
Translation: 0x0429 0x04e7

Win32/Kryptik.HJTB also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKDZ.73300
FireEyeGeneric.mg.969d78331a68abee
CAT-QuickHealTrojan.Azorult
McAfeePacked-GBF!969D78331A68
CylanceUnsafe
AegisLabTrojan.Win32.Deyma.a!c
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderTrojan.GenericKDZ.73300
K7GWTrojan ( 00578abb1 )
K7AntiVirusTrojan ( 00578abb1 )
CyrenW32/Kryptik.DMC.gen!Eldorado
APEXMalicious
AvastWin32:BotX-gen [Trj]
ClamAVWin.Malware.Tofsee-9839482-1
KasperskyHEUR:Trojan.Win32.Zenpak.pef
AlibabaTrojan:Win32/Azorult.5b48a2b2
NANO-AntivirusTrojan.Win32.Deyma.inyhrv
RisingTrojan.Kryptik!1.D345 (CLOUD)
Ad-AwareTrojan.GenericKDZ.73300
DrWebTrojan.DownLoader37.2389
McAfee-GW-EditionBehavesLike.Win32.Generic.fh
SophosMal/Generic-R + Troj/Kryptik-TR
SentinelOneStatic AI – Malicious PE
AviraTR/Crypt.Agent.tcdmz
Antiy-AVLTrojan/Win32.Zenpak
GridinsoftTrojan.Win32.Downloader.sa
ArcabitTrojan.Generic.D11E54
AhnLab-V3Malware/Gen.RL_Reputation.R369333
ZoneAlarmHEUR:Trojan.Win32.Zenpak.pef
CynetMalicious (score: 100)
ESET-NOD32a variant of Win32/Kryptik.HJTB
Acronissuspicious
VBA32BScope.Backdoor.Mokes
ALYacTrojan.GenericKDZ.73300
MalwarebytesTrojan.MalPack
PandaTrj/GdSda.A
IkarusTrojan.Win32.Crypt
eGambitUnsafe.AI_Score_56%
FortinetW32/GenKryptik.FCLA!tr
AVGWin32:BotX-gen [Trj]
Cybereasonmalicious.31a68a
Paloaltogeneric.ml
Qihoo-360Win32/Trojan.Generic.HwoCqccA

How to remove Win32/Kryptik.HJTB?

Win32/Kryptik.HJTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment