Win32/Kryptik.HNJB information

The Win32/Kryptik.HNJB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HNJB virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Spanish (Paraguay)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
CAPE detected the Raccoon malware family
Created network traffic indicative of malicious activity

Related domains:

wpad.local-net

telegalive.top

toptelete.top

How to determine Win32/Kryptik.HNJB?


File Info:
name: 329F9EC91B686B77EA10.mlw
path: /opt/CAPEv2/storage/binaries/12ed9c2601fb61927e8dcf4fdf0faeceb312bb9ca87016486ea2836c0853ef2b
crc32: B9DE4ED6
md5: 329f9ec91b686b77ea10a590d608b6ac
sha1: d4fa87b21345093bf5c92bdb15be3495a78b9812
sha256: 12ed9c2601fb61927e8dcf4fdf0faeceb312bb9ca87016486ea2836c0853ef2b
sha512: 24106e58363f351e9efe9a0bbf2749ce1ac8f07d06a217053de22e87a208ccc57ba1b320595f796f7ab3c7b8fb763c06d2de5cfb0f550e3c6fb2e46309829435
ssdeep: 12288:G0gYn1mRu/0u0WM+mVQDqtppk4x6FbrteSpAL/L7+2vEMv9:GxY1mRu/0tWM+mbppk48FbrtpuLG2f
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T178D4D000B6A0C034F1B716F89D7A6668B93E7A916B3194CF62C516FA8734AE1FC31357
sha3_384: 4fe99d57a86caf10b6410fb89a37d6786ca72fb1add433984187fea1a2975d2a726dce3f01fa0163e43ec996d472a997
ep_bytes: 8bff558bece8b6480000e8110000005d
timestamp: 2020-11-22 15:34:20

Version Info:
Translations: 0x0022 0x023c

Win32/Kryptik.HNJB also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Babar.29261
FireEye	Generic.mg.329f9ec91b686b77
ALYac	Gen:Variant.Babar.29261
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Raccoon.3a948427
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
Baidu	Win32.Trojan.Kryptik.jm
Cyren	W32/Kryptik.FQI.gen!Eldorado
Symantec	Packed.Generic.620
ESET-NOD32	a variant of Win32/Kryptik.HNJB
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Zenpak.gen
BitDefender	Gen:Variant.Babar.29261
Avast	Win32:PWSX-gen [Trj]
Rising	Trojan.Generic@ML.92 (RDML:A98L/A/oOTJyj2h3+5BH0A)
Ad-Aware	Gen:Variant.Babar.29261
Sophos	ML/PE-A + Troj/Krypt-DY
TrendMicro	TROJ_GEN.R002C0DKN21
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
Emsisoft	Trojan.Crypt (A)
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.BSE.WS9D4D
MAX	malware (ai score=89)
Arcabit	Trojan.Babar.D724D
Microsoft	Trojan:Win32/Raccoon.AW!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	CoinMiner/Win.Glupteba.R450913
Acronis	suspicious
McAfee	Packed-GDT!329F9EC91B68
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Trojan.MalPack.GS
TrendMicro-HouseCall	TROJ_GEN.R002C0DKN21
Tencent	Win32.Trojan.Zenpak.Ljat
Ikarus	Trojan.Win32.Crypt
eGambit	Unsafe.AI_Score_97%
Fortinet	W32/GenKryptik.FNRJ!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/Genetic.gen
MaxSecure	Trojan.Malware.300983.susgen

How to remove Win32/Kryptik.HNJB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Kryptik.HNJB information