Should I remove “Win32:Crypt-RPY [Trj]”?

The Win32:Crypt-RPY [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:Crypt-RPY [Trj] virus can do?

Sample contains Overlay data
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family

How to determine Win32:Crypt-RPY [Trj]?


File Info:
name: 50A65363226BF9C19EED.mlw
path: /opt/CAPEv2/storage/binaries/7ae1c2b304629aed7705c0a4e7b6ebaa987eecb4ab312ceb34936e412624bd6e
crc32: 32463D51
md5: 50a65363226bf9c19eed26ffc5e09bf9
sha1: cb69cf6b3122f0669261269827eb4aec032304b1
sha256: 7ae1c2b304629aed7705c0a4e7b6ebaa987eecb4ab312ceb34936e412624bd6e
sha512: 7c3fe3e7350f48547c716d9c2bfa9c3804f5e1bfbc7396d6d2bf3fac79dd12386bd1d5c6b29119157135c5dac7162ee6ce540a0ce6005226f79ed7743604d06a
ssdeep: 96:OdfxZdWjj++ZdLi1eIcksQq5imCLQNjXkQs/u26ajGBIzFS:OdlkJ21eIH3HLSX9vB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C6F13983DE03903AFB6D09B107CD8D56F277A90C436425EBAF79082665F2B211030A42
sha3_384: 717b02f2a88f2d6dd47160e6ad1e30711d0a3d09c0a7987559b0d1dbed0baa0be53544a60a9296108e22685ffb8293e3
ep_bytes: 00000000000000000000000000000000
timestamp: 2006-03-05 10:13:46

Version Info:
0: [No Data]

Win32:Crypt-RPY [Trj] also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Win32.Worm.Nimda.O
FireEye	Generic.mg.50a65363226bf9c1
Skyhigh	W32/Chir.gen@MM!remanants
McAfee	W32/Chir.gen@MM!remanants
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Worm.Win32-Script.Save.Nimda
K7AntiVirus	Trojan ( 0008d46e1 )
K7GW	Trojan ( 0008d46e1 )
Arcabit	Win32.Worm.Nimda.O
Baidu	Win32.Trojan.Agent.bf
VirIT	Win32.Runouce.D
Symantec	IFrame.Exploit
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Virus.Win32.Chir.gen
BitDefender	Win32.Worm.Nimda.O
Avast	Win32:Crypt-RPY [Trj]
Emsisoft	Win32.Worm.Nimda.O (B)
F-Secure	Malware.W32/Chir.B
VIPRE	Win32.Worm.Nimda.O
TrendMicro	WORM_CHIRR.DAM
Sophos	Mal/Generic-S
Ikarus	Email-Worm.Win32.Runouce
Google	Detected
Avira	W32/Chir.B
Antiy-AVL	Worm[Net]/Win32.Nimda.gic
Xcitium	EmailWorm.Win32.Runonce.~v001@1qup51
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Virus.Win32.Chir.gen
GData	Win32.Worm.Nimda.O
MAX	malware (ai score=84)
VBA32	suspected of Win32.Zero.Heur
Panda	W32/Chir.P.worm
TrendMicro-HouseCall	WORM_CHIRR.DAM
Rising	Trojan.Generic@AI.98 (RDML:4h41tvWEJv2F8sfQwjpFQA)
Fortinet	W32/Runouce.B!tr
AVG	Win32:Crypt-RPY [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Win32:Crypt-RPY [Trj]?

Win32:Crypt-RPY [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X