Categories: Malware

How to remove “Win32/Kryptik.HOGO”?

The Win32/Kryptik.HOGO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.HOGO virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Unconventionial language used in binary resources: Finnish
Authenticode signature is invalid

How to determine Win32/Kryptik.HOGO?


File Info:
name: 51093969F0C7D6833BE4.mlwpath: /opt/CAPEv2/storage/binaries/7817c2778d416d102a4b9fde02f021f79608537f5b4d0af01ea1cdc0a8d94bb7crc32: BD121419md5: 51093969f0c7d6833be4aca353316153sha1: 2a37533db3da90f736d44cea21af620351d35578sha256: 7817c2778d416d102a4b9fde02f021f79608537f5b4d0af01ea1cdc0a8d94bb7sha512: 1120d769741e00de7501a3f1f24c8b7df3902f970aa14dd4515ddf361c3ae1dc414e4f036c45b2756a7afbdfba327af93800bbc72d3ef6f0668a1e540f9b7fa1ssdeep: 3072:2hKOqPL8VuR/ZI5Kkjp4OkCcEiLShH+V5S7z6rfUZG0xsxkgaBChu9XCV:2UPLcuR9wqNtLShHHarMZG0Gigal2type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B654CE027A91C8B1D4861D745825CAE04A7FF972DA20A187F76BFB6F6F703E05722346sha3_384: 7331a821c4a85517544ff7630abfcb200e06ff6e46cb5a558946e9b1171769d8f739c40b339b2f0d9d57a24bf6f24574ep_bytes: e863430000e979feffff8bff51c70130timestamp: 2021-03-11 19:04:02
Version Info:
FileVersion: 21.79.11.69InternationalName: pomgveoci.iweCopyright: Copyrighz (C) 2021, fudkortaProjectVersion: 5.63.41.44Translations: 0x0127 0x010f

Win32/Kryptik.HOGO also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.48265401
FireEye	Generic.mg.51093969f0c7d683
ALYac	Trojan.GenericKD.48265401
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0053d5971 )
Alibaba	Ransom:Win32/GandCrab.73ea3f8b
K7GW	Trojan ( 0053d5971 )
Cyren	W32/Injuke.M.gen!Eldorado
Symantec	Packed.Generic.525
ESET-NOD32	a variant of Win32/Kryptik.HOGO
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.LokiBot-9938483-0
Kaspersky	HEUR:Trojan-Ransom.Win32.Stop.gen
BitDefender	Trojan.GenericKD.48265401
Avast	Win32:CrypterX-gen [Trj]
Ad-Aware	Trojan.GenericKD.48265401
Sophos	Mal/Generic-S + Mal/Agent-AWV
DrWeb	Trojan.Siggen16.39747
TrendMicro	TROJ_GEN.R002C0PB522
McAfee-GW-Edition	BehavesLike.Win32.Upatre.dm
Emsisoft	Trojan.GenericKD.48265401 (B)
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKD.48265401
Avira	HEUR/AGEN.1242353
MAX	malware (ai score=81)
Antiy-AVL	Trojan/Generic.ASMalwS.3521874
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Generic.D2E078B9
ZoneAlarm	HEUR:Trojan-Ransom.Win32.Stop.gen
Microsoft	Trojan:Win32/Raccrypt.GO!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Infostealer/Win.SmokeLoader.R470642
McAfee	Packed-GDT!51093969F0C7
VBA32	Trojan.Convagent
Malwarebytes	Trojan.MalPack.GS
TrendMicro-HouseCall	TROJ_GEN.R002C0PB522
Rising	Malware.Undefined!8.C (CLOUD)
Ikarus	Packed.Win32.Crypt
eGambit	Unsafe.AI_Score_85%
Fortinet	W32/GenKryptik.ERHN!tr
BitDefenderTheta	Gen:NN.ZexaF.34212.sq0@ams4gGlK
AVG	Win32:CrypterX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen