Win32/Kryptik.HMVR malicious file

The Win32/Kryptik.HMVR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HMVR virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Attempts to connect to a dead IP:Port (3 unique times)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• CAPE detected the PCRat malware family
• Creates a copy of itself
• Anomalous binary characteristics

How to determine Win32/Kryptik.HMVR?

File Info:
name: F7802CC4D709ED5476D6.mlw
path: /opt/CAPEv2/storage/binaries/39bf871bfa890646579786d7373b93ca45411631058e637b864d8825217e8387
crc32: AAECFC9D
md5: f7802cc4d709ed5476d63ef4b06a8dc7
sha1: a4de605fe772bf8aae0e8cb52a7554c04521b492
sha256: 39bf871bfa890646579786d7373b93ca45411631058e637b864d8825217e8387
sha512: 069e74e5b007b8d124c4f0f80743f0f400ae9455e94d9ec6b87124750c85ba474b0d489e318ffbd5e721deb8254463fc4bc931fca3f58d01e614c25fd6ec2b71
ssdeep: 24576:rpvPrUrMFG9E3GRzKp6GK6E/nXoAgNq9f:DGcoGK6EvoAgQf
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A5450B7F1BF207FA8E0E107096D04B6B8173599FAC2199E425667D2CE939F001B5A9CF
sha3_384: f0a74199e641e6b7e05230a96b40a588918243d199da1740bccb2ca1f6a4b7f637329762d9d873438ffb4530a4d4a3d0
ep_bytes: eb09e6f8f45a49885a224160eb023f15
timestamp: 2021-09-16 07:14:12

Version Info:
CompanyName: 
FileDescription: AboutHtml Application by Paul DiLascia
FileVersion: 1, 0, 0, 1
InternalName: AboutHtml
LegalCopyright: Copyright ? 1998 Paul DiLascia
LegalTrademarks: 
OriginalFilename: AboutHtml.EXE
ProductName: AboutHtml
ProductVersion: 1, 0, 0, 1
Translation: 0x0804 0x04b0

Win32/Kryptik.HMVR also known as:

How to remove Win32/Kryptik.HMVR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.