About “Win32:FakeInstaller-B [Cryp]” infection

The Win32:FakeInstaller-B [Cryp] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:FakeInstaller-B [Cryp] virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Collects information to fingerprint the system

How to determine Win32:FakeInstaller-B [Cryp]?

File Info:
name: 6A8CF7E06A8D06AA8BD4.mlw
path: /opt/CAPEv2/storage/binaries/a291f7f6f9a7882538ff7609ba68b0cd502498c98bfb1eaadfd4e614f9610434
crc32: E9030865
md5: 6a8cf7e06a8d06aa8bd4c385f65086ba
sha1: 234c1a24b57e1ed14085e313337567bd4e8c3646
sha256: a291f7f6f9a7882538ff7609ba68b0cd502498c98bfb1eaadfd4e614f9610434
sha512: d7485dbd1f69d55cd5cb793d3135a53e3d922d7af4326aa5c85b1df7201be9354162d973ecd65a77d020802b234493bdf3ce25259f0c17be4dadd42079a0a94d
ssdeep: 196608:TrKXf7+bQlwk9tNT1seJKwtpUb58psVxfrsqLswjWyRtXygopnxb:TOXSEl7tNT19nLUbFHLZRtXXYnxb
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12B8633731701AA87D903B170C5E35A6046E25DBE587A2C231780AFFB770BAE7312E756
sha3_384: a466466b3381e2527a029d5fa99769714c7a0ef60c46fe5e9b78ae0a1be87a032edf590d449aae4b4bbfaced0f982601
ep_bytes: 81ec8401000053565733db6801800000
timestamp: 2020-08-01 02:44:50

Version Info:
CompanyName: Andrew Young
FileDescription: Secure Device Manager
FileVersion: 2.1.2.2
LegalCopyright: Copyright Andrew Young
ProductName: secdev
Translation: 0x0409 0x04e4

Win32:FakeInstaller-B [Cryp] also known as:

How to remove Win32:FakeInstaller-B [Cryp]?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.