Categories: Malware

Win32/Kryptik.HNNA removal instruction

The Win32/Kryptik.HNNA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HNNA virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
HTTPS urls from behavior.
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Spanish (Paraguay)
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Steals private information from local Internet browsers
Attempts to modify proxy settings
Harvests cookies for information gathering

Related domains:

wpad.local-net

advanceddiplomaaviation.com

incoming.telemetry.mozilla.org

aus5.mozilla.org

How to determine Win32/Kryptik.HNNA?


File Info:
name: DFD5C5830452A4322028.mlwpath: /opt/CAPEv2/storage/binaries/27efd366c042e167e2237736acd34ba2b834ff6ddfacc419e7889c71d1909723crc32: 41FE497Emd5: dfd5c5830452a4322028d6000c38cad8sha1: 6a7e0482cf0030012ed6afc00c3e06e89885a24bsha256: 27efd366c042e167e2237736acd34ba2b834ff6ddfacc419e7889c71d1909723sha512: 70e4418a8285a8dd9d6db005f9b6f98a588fc167d921bf07d3839a0cf8723cb2106520fd9d54da951e1a4b31cbc821cef6398189dd9fe221d6853e9abfa85ea2ssdeep: 3072:io01pQ7yAebUyRPYKrenS4EPOyAiiODlktQYe9e+VLng84UrNPwfEu6ZY9u9WW:FRKr54/iiMs09euLn9thPwcIutype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T167649F147BA0C834F5BB17F859B9D3A97A3E79A16B3890CB62D117EA46356D0DC30307sha3_384: 242d2b16228be0dc1b89fff076c54b18069477bbef4a3551c0107788f69418313637a34226c8e48fca340389ede57298ep_bytes: 8bff558bece806030000e8110000005dtimestamp: 2020-07-31 09:45:55
Version Info:
0: [No Data]

Win32/Kryptik.HNNA also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Mokes.m!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.dfd5c5830452a432
CAT-QuickHeal	Trojan.Azorult
McAfee	RDN/GenericM
Malwarebytes	Trojan.MalPack.GS
Sangfor	Backdoor.Win32.Mokes.gen
K7AntiVirus	Trojan ( 0058a5a11 )
Alibaba	Malware:Win32/km_24af8.None
K7GW	Trojan ( 0058a5a11 )
Cybereason	malicious.2cf003
Baidu	Win32.Trojan.Kryptik.jm
Cyren	W32/Kryptik.FQI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HNNA
TrendMicro-HouseCall	TROJ_GEN.R049C0DKQ21
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Chapak.gen
BitDefender	Trojan.GenericKDZ.81106
MicroWorld-eScan	Trojan.GenericKDZ.81106
Avast	Win32:BotX-gen [Trj]
Tencent	Win32.Trojan.Chapak.Wwxx
Ad-Aware	Trojan.GenericKDZ.81106
Sophos	Mal/Generic-R + Troj/Krypt-DY
Zillya	Trojan.Kryptik.Win32.3626953
TrendMicro	TROJ_GEN.R049C0DKQ21
McAfee-GW-Edition	BehavesLike.Win32.Upatre.fh
Emsisoft	Trojan.Crypt (A)
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.PSE.11CIAVD
Jiangmin	Trojan.Chapak.pgb
Avira	TR/Redcap.nypuz
MAX	malware (ai score=85)
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.STOP.sa
ViRobot	Trojan.Win32.Z.Jaik.313344.B
Microsoft	Trojan:Win32/Azorult.RMA!MTB
AhnLab-V3	Ransomware/Win.Stop.R452790
Acronis	suspicious
ALYac	Trojan.GenericKDZ.81106
VBA32	BScope.Trojan.Krypter
APEX	Malicious
Rising	Malware.Obscure/Heur!1.A89F (CLASSIC)
Ikarus	Trojan.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.FOCX!tr
Webroot	W32.Trojan.Gen
AVG	Win32:BotX-gen [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_90% (W)