Win32/Kryptik.RHB (file analysis)

The Win32/Kryptik.RHB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.RHB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Creates a copy of itself
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Kryptik.RHB?

File Info:
name: 5B8F44B2D0F2D800381C.mlw
path: /opt/CAPEv2/storage/binaries/a6ea605eb37c252e7c084c37ab5ac309e29ddd28553c5cfafc34c80a032d3aee
crc32: 23FB411E
md5: 5b8f44b2d0f2d800381cd54fff64e93f
sha1: bfb07e84ed4ee4bd06c8f71b31cff8bef5787a0b
sha256: a6ea605eb37c252e7c084c37ab5ac309e29ddd28553c5cfafc34c80a032d3aee
sha512: 679364a1748f357059ba87b9bf13399836ca945da8efbce0b3d4f8b6d83537b905605e45da1c739189d642b1ba810b99815efadf408e2fccdfc9b30be298495b
ssdeep: 3072:LCUgOuXJbr+zHBD/rzBiC3C4H8h88FGQNMqloD/iKWYQ5Y5zDsl+:LZ6XJArBiCy7VF1mAYc+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F1149DB39656B1B1C416AB393131B14D16073E308A9EDA16E304C43BEDB69F25E81BDB
sha3_384: 0e6fa2d0704a64fad7caba1878483c453bc8ad5ef0b5742bda59a933cb3cd8b131a3af5e8dce828c0be15e74762d87c3
ep_bytes: 830504e042000a730c031500e0420089
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Win32/Kryptik.RHB also known as:

How to remove Win32/Kryptik.RHB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.