Win32/Kryptik.HNXE information

The Win32/Kryptik.HNXE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HNXE virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the DanaBot malware family

How to determine Win32/Kryptik.HNXE?

File Info:
name: DEEDD92AE1C2A1D5A66A.mlw
path: /opt/CAPEv2/storage/binaries/fa2e4b9b42451bc3aa2215500f7ab1f51cdb19414a8ae50acefb9945729e37aa
crc32: C1B17615
md5: deedd92ae1c2a1d5a66a1b0380f15925
sha1: b619f14fbffde3d70c76a33bb049b0deefc80e77
sha256: fa2e4b9b42451bc3aa2215500f7ab1f51cdb19414a8ae50acefb9945729e37aa
sha512: 80e83335d16e66ffb03f6668d10593f2e0c84c3e744fe3eb93773257963b62a6e6370d6ca99a765abaa854b2a086e62c5fe2131109d898f3b126713856458f26
ssdeep: 49152:fC5RmTMwXw2kmO6TxNNnVyJuOgPubfbd0k:qXkR7kUTxTnVyiwOk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D5852312B672FCB1C4E21A364474C7D10E7FB4609699859E6004097F7FB32A4BE9E39E
sha3_384: 2493443ae3e17c91322bfdbf597b81d2966c1a384b360665f053b87b3a9d3f67b0ed7b1f5a343dd288c819a93dfae701
ep_bytes: e8e0330000e978feffffcccccccccccc
timestamp: 2021-06-09 11:33:15

Version Info:
InternationalName: bomgvioci.iwa
Copyright: Copyrighz (C) 2021, fudkort
ProjectVersion: 3.14.70.77
Translation: 0x0129 0x0794

Win32/Kryptik.HNXE also known as:

How to remove Win32/Kryptik.HNXE?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.