Win32/Kryptik.HOGN malicious file

The Win32/Kryptik.HOGN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HOGN virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Finnish
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location

How to determine Win32/Kryptik.HOGN?

File Info:
name: F9B5CE77ADCB4C73BB4D.mlw
path: /opt/CAPEv2/storage/binaries/123265fab330bf5024ead1f70f9a7caf072011272106f9fd0bf0bf3b284da019
crc32: 8E4B7035
md5: f9b5ce77adcb4c73bb4d0deae71161ac
sha1: 88d3e7c0d3d08730b1d93c78cdccf40d88ff7a48
sha256: 123265fab330bf5024ead1f70f9a7caf072011272106f9fd0bf0bf3b284da019
sha512: b1e7282cb06ad0e833314cde5fa5d5e8f03e4cb3f42965e95c8c9af42b00aa05c24ad3b70c11043278cd3bc7ed4a5cae0c62c8597f94daf5d4f484fd0b6283b9
ssdeep: 3072:hz6J+AH26QQwL0ipFCLgf5764tsB5xosxkgaBChXVNIs4E472:hefHFwLXXnJsrigaCIB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19544BD013693D472CD955D349135DBA11A3FF8324965A64BF768BB2E2F303E2AB72306
sha3_384: ab512aa37ec212771f958d1a0a5acfc494edbfac39bbeef2c0c14e9bfbee9f099b58745d4d6b53752e698161e9120b88
ep_bytes: e8c25d0000e979feffff8bff51c70158
timestamp: 2021-02-09 04:51:28

Version Info:
FileVersion: 21.79.11.69
InternationalName: pomgveoci.iwe
Copyright: Copyrighz (C) 2021, fudkorta
ProjectVersion: 1.10.70.57
Translations: 0x0127 0x010e

Win32/Kryptik.HOGN also known as:

How to remove Win32/Kryptik.HOGN?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.