How to remove “Win32/Kryptik.HSQQ”?

The Win32/Kryptik.HSQQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Kryptik.HSQQ virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
CAPE detected the RedLine malware family
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Win32/Kryptik.HSQQ?


File Info:
name: 478F480D9F8684B8F813.mlw
path: /opt/CAPEv2/storage/binaries/baf8faefc231fab318b558f7636fb63a263e9c0d1d6ef35cabe1dcc0e97cb00b
crc32: A44E2184
md5: 478f480d9f8684b8f8139f9bac744e96
sha1: b1d69d36fd362ffabc767178b16c11dc07ed0153
sha256: baf8faefc231fab318b558f7636fb63a263e9c0d1d6ef35cabe1dcc0e97cb00b
sha512: 74323e0742ea056a786d897f7d2845077872c5b564cbfc1b318f84befcd96f79112032aef79c2b3e0d6a354510a74ab332981ae652d0cbaa9639c7e405fbd28b
ssdeep: 6144:yWHJHqrBrVnsxjAOHJl+twHINDUbPiwwScw:ysJHqn6RJl+tCINDUbPiic
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T108553A827C5450ABC8A21C3889508962F529746F26B23B97DEDBB91CE5D31F07D23E3D
sha3_384: 91f1508374339da32608e522c38419ebb647cbac93e59e00e41729d66f332a6d6aa4c41e8f6007cb00d35ec104dda9cd
ep_bytes: e811040000e974feffff3b0d14b04200
timestamp: 2023-03-05 10:46:05

Version Info:
0: [No Data]

Win32/Kryptik.HSQQ also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.6fd362
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HSQQ
APEX	Malicious
Kaspersky	VHO:Backdoor.Win32.Agent.gen
DrWeb	Trojan.PWS.Steam.34510
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.478f480d9f8684b8
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan.Win32.Crypt
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	VHO:Backdoor.Win32.Agent.gen
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R560907
Acronis	suspicious
Malwarebytes	Malware.Heuristic.1001
Rising	Exploit.Agent!8.1B (TFE:5:9J8VvHcT0XH)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.HSIR!tr
BitDefenderTheta	Gen:NN.ZexaF.36308.uvW@a4JZ63d
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Win32/Kryptik.HSQQ?

Win32/Kryptik.HSQQ removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X