Malware

Win32/Kryptik.HNDX information

Malware Removal

The Win32/Kryptik.HNDX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32/Kryptik.HNDX virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (3 unique times)
  • Creates RWX memory
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Reads data out of its own binary image
  • Performs some HTTP requests
  • The binary likely contains encrypted or compressed data.
  • Looks up the external IP address
  • Creates a copy of itself

Related domains:

api.ipify.org

How to determine Win32/Kryptik.HNDX?


File Info:

crc32: 52E2EEF6
md5: 6f62793171695b4aca9efd529e7eb75b
name: 6F62793171695B4ACA9EFD529E7EB75B.mlw
sha1: 1d13234cbde273e12135a4ca9c02594213c7270e
sha256: ae7206c887ef1e1f9e910267724ef82a11b431c2a2d489f1cd4e7fdce997fe64
sha512: 753f79d1886912f0d415dd5c2e93a16a3127decaba771ffb72884eaeda274dfbebff8d49a5806cf232c8846511a0287761d4a58932e90ac1139e981a6531a1a5
ssdeep: 12288:m1d+w0o2/pnRsHnF2XqBNiKtxRDB02HTUj/AUYQ+wsE6tn6tKB:Mesl2XqBNicTtZQO11B
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2004 Fred Ackers
InternalName: waveInFFT
FileVersion: 1, 3, 0, 0
ProductName: waveInFFT Application
ProductVersion: 1, 3, 0, 0
FileDescription: waveInFFT MFC Application
OriginalFilename: waveInFFT.EXE
Translation: 0x0409 0x04b0

Win32/Kryptik.HNDX also known as:

K7AntiVirusTrojan ( 00589aad1 )
LionicTrojan.Win32.Trickpak.4!c
Elasticmalicious (high confidence)
ALYacTrojan.GenericKD.37903782
SangforTrojan.Win32.Trickpak.gen
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojan:Win32/Trickpak.aa532f1d
K7GWTrojan ( 00589aad1 )
CyrenW32/TrickBot.GT.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HNDX
APEXMalicious
AvastWin32:CrypterX-gen [Trj]
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Trickpak.gen
BitDefenderTrojan.GenericKD.37903782
MicroWorld-eScanTrojan.GenericKD.37903782
Ad-AwareTrojan.GenericKD.37903782
SophosMal/Generic-R + Troj/Trickb-DG
TrendMicroTROJ_GEN.R002C0RK121
McAfee-GW-EditionBehavesLike.Win32.Dropper.ch
FireEyeGeneric.mg.6f62793171695b4a
EmsisoftTrojan.GenericKD.37903782 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Trickpak.ls
AviraTR/AD.Emotet.julae
MicrosoftTrojan:Win32/TrickBotCrypt.EW!MTB
GDataTrojan.GenericKD.37903782
AhnLab-V3Malware/Win.Generic.C4741707
McAfeeTrickbot-FUAR!6F6279317169
MAXmalware (ai score=80)
VBA32Trojan.Trickpak
MalwarebytesTrojan.TrickBot
PandaTrj/GdSda.A
RisingTrojan.Generic@ML.87 (RDML:MlO3ko1NsMXSi30tIiNW/Q)
YandexTrojan.Trickpak!RkUMihX+400
IkarusTrojan.Win32.Krypt
MaxSecureTrojan.Malware.300983.susgen
FortinetPossibleThreat.PALLAS.H
AVGWin32:CrypterX-gen [Trj]
Paloaltogeneric.ml

How to remove Win32/Kryptik.HNDX?

Win32/Kryptik.HNDX removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment