What is “Win32/Kryptik.RVB”?

The Win32/Kryptik.RVB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Kryptik.RVB virus can do?

Sample contains Overlay data
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Win32/Kryptik.RVB?


File Info:
name: D53E6FACB0D48C8FB3F1.mlw
path: /opt/CAPEv2/storage/binaries/6d1c371d94854c77830da6dc55e4878a0a503e968d5373a6a323c67f4c967d7e
crc32: C95A5EC6
md5: d53e6facb0d48c8fb3f1e2c599a47bf9
sha1: 0be050f034eb947f1de4f91d3633a0feaadb3d88
sha256: 6d1c371d94854c77830da6dc55e4878a0a503e968d5373a6a323c67f4c967d7e
sha512: 0930985e1f3b0a21596a6cd10bf923047de92fb790ce209309e00d736e1459cb8ee83cb7df0a804e1c8521ae145f5e4c43c0bceef87c3d9576b26ee514f01a2a
ssdeep: 96:F2NMz9u2mWDHvn6Hyd8rHXAuHJU6peGwWF8k76SFh/JiF4PLWlDgwi:Po0mSd8rhpU6pVwRQ6SX/EF4KBi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T109D11801B6E58536D8A94F3111924342ABBF6D2445B1610E0F6F5DA9BB73D278F2833A
sha3_384: d43844a937ab152511c661b24ef54c65f84a35f0e4b9ea3416d05d1ba0cb6bec57b89764ce2ccdcb3ce67320362036b4
ep_bytes: 6a00e84e050000a3fb354000e83e0500
timestamp: 2011-08-20 18:05:03

Version Info:
0: [No Data]

Win32/Kryptik.RVB also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Jorik.lpXt
Elastic	malicious (high confidence)
FireEye	Generic.mg.d53e6facb0d48c8f
McAfee	PWS-Zbot.gen.kr
Alibaba	VirTool:Win32/Injector.51bcc23a
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	Trojan.Gen.MBT
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.RVB
APEX	Malicious
ClamAV	Win.Trojan.6806876-1
Avast	Win32:Kryptik-EJF [Trj]
Tencent	Malware.Win32.Gencirc.114951a0
Comodo	Malware@#269940vijh9qz
Zillya	Trojan.Genome.Win32.130668
McAfee-GW-Edition	PWS-Zbot.gen.kr
Trapmine	malicious.high.ml.score
Sophos	Mal/EncPk-ACO
Ikarus	Worm.Win32.Rebhip
Jiangmin	TrojanDownloader.Agent.dfne
Webroot	W32.Malware.Gen
Google	Detected
MAX	malware (ai score=99)
Antiy-AVL	Trojan/Generic.ASMalwS.13
Microsoft	VirTool:Win32/Injector.gen!CF
Cynet	Malicious (score: 100)
AhnLab-V3	Downloader/Win32.Agent.C124584
VBA32	TrojanDownloader.Agent
Rising	Malware.Undefined!8.C (TFE:4:rkf0GUlUmoD)
Yandex	Trojan.Injector!Me1M12IeWoQ
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Jorik.QF!tr
AVG	Win32:Kryptik-EJF [Trj]
Cybereason	malicious.034eb9
Panda	Generic Malware

How to remove Win32/Kryptik.RVB?

Win32/Kryptik.RVB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X