Win32/Kryptik.HNAL malicious file

The Win32/Kryptik.HNAL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HNAL virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Czech
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the Vidar malware family
• Attempts to modify proxy settings
• Harvests cookies for information gathering

How to determine Win32/Kryptik.HNAL?

File Info:
name: 7F7F0ACE869558360AAD.mlw
path: /opt/CAPEv2/storage/binaries/3b14043363b8b8645093e4c1c71e421a78ad64a86b20052ebacb282197524a9e
crc32: 954E69AE
md5: 7f7f0ace869558360aad4071dddee87d
sha1: 9fb377ffcafbe0e96c33abeb57cbc482a6b865a6
sha256: 3b14043363b8b8645093e4c1c71e421a78ad64a86b20052ebacb282197524a9e
sha512: 44d143ec986df9753ee30804ed34d7ff3c54dd377820a036b20e56979a81165de92d0faae558f24f76f7e9ca8badaa102b275a509eb72fdff4ece4eb56e8c6d4
ssdeep: 12288:EgAN9vrVMB4llEtPn1MTQl+ZM1YpbiAfWhVTenXtxD:Ej3TXap1c4+OYZfWheXt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E1E402B972989475C5612530C836CBED1B3AB851F620417AF76327AFDEF82909E2D343
sha3_384: 01a76fe201846219ed0a40ec5ab090ef136b22c23f410a7b811269b05bb45ce63e4b28252c0e0d7690e7d4cf0de27ba4
ep_bytes: e8a94a0000e989feffff8bff558bec51
timestamp: 2021-01-24 10:10:14

Version Info:
InternalName: namgpiamico.iwa
Copyright: Copyrighz (C) 2021, fudkagat
ProductVersion: 91.40.21.87
Translation: 0x0196 0x03fd

Win32/Kryptik.HNAL also known as:

How to remove Win32/Kryptik.HNAL?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.