About “Win32/Kryptik.QMJ” infection

The Win32/Kryptik.QMJ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.QMJ virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• CAPE detected the embedded win api malware family
• Enumerates physical drives
• Attempted to write directly to a physical drive
• Deletes executed files from disk
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Kryptik.QMJ?

File Info:
name: 0618BA2A63F1755AFB38.mlw
path: /opt/CAPEv2/storage/binaries/5e4295fe20e6a39d30f38af83e2d5e52a592d23dd1950c881e86b69c5f9219e3
crc32: 07BD7886
md5: 0618ba2a63f1755afb38fa8551d191b8
sha1: bf340195be7889b4823108c8acba1507506732a9
sha256: 5e4295fe20e6a39d30f38af83e2d5e52a592d23dd1950c881e86b69c5f9219e3
sha512: d51032cc23bba084b4c4758069d56689df32fbf1b324427623cbe9898c050f231971b787592dd08f8f95e8d8f77e527e95684a21e9d76c764eb0d1c565ed1762
ssdeep: 24576:2+nrvgkMtxrA4K667tdHnZnAtBo3Fwil:XrWXA4t6hlZAzo+6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10F2523C7727A8CA9E7213371089329C9C03BFA36EA98DE571F7111078D16F66489376B
sha3_384: 29fa27a28744b02535b448cc55f67d4fb9e1d21a70245d71d7f06faf0dd64b5e0232929de94632ae8e403c59358e30a0
ep_bytes: 60be001060008dbe0000e0ff5789e58d
timestamp: 2011-07-18 03:10:30

Version Info:
CompanyName: Kaspersky Lab
FileDescription: Ddpuuqerelyuchloxpdjirqlxllx
FileVersion: 1.2.1.118
InternalName: Qdu.exe
LegalCopyright: Copyright (C) YYYAGG Software
OriginalFilename: Uuq.exe
ProductName: Athon
ProductVersion: 1.2.1.118
Translation: 0x001b 0x04b0

Win32/Kryptik.QMJ also known as:

How to remove Win32/Kryptik.QMJ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.