Categories: Malware

About “Win32:Kryptik-AZJ [Trj]” infection

The Win32:Kryptik-AZJ [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Kryptik-AZJ [Trj] virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Yara rule detections observed from a process memory dump/dropped files/CAPE
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Drops a binary and executes it
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities for basic functionality
Checks the version of Bios, possibly for anti-virtualization
Checks the presence of disk drives in the registry, possibly for anti-virtualization
Attempts to modify proxy settings
Deletes executed files from disk
The sample wrote data to the system hosts file.
Collects information to fingerprint the system
Anomalous binary characteristics

How to determine Win32:Kryptik-AZJ [Trj]?


File Info:
name: E99BE4C0CDF17B335C4E.mlwpath: /opt/CAPEv2/storage/binaries/b11ca8576bbce98608924c84e4d3892d2450babc069b96f14de775033e3bc009crc32: C350CDB0md5: e99be4c0cdf17b335c4e43ad8c92eadasha1: bd344009692111a90018a97e95585e6346932cb1sha256: b11ca8576bbce98608924c84e4d3892d2450babc069b96f14de775033e3bc009sha512: e2b33c601d63b21e5137eaf06ba3e974396c1e7c71f7b6116d39c5467764b1ec6a1d3abfe879251dec2f52daf51dcc3573998fe005546682b7aa0d3dc9765292ssdeep: 6144:X7ZSRCVrwYJ7PEduK+fvrZZxoKGpPBEbbe1fHFFYmd6ra3tOF9OnChwvtb:X7wi0E7PFK+Ltxs56IFimdlETwvtbtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1FD74F0907FA1C472C2576974CE49C26BA9207FB568F0985773D20F9B3936852CA3363Bsha3_384: 1d3657a639e29d21a9602a0d5145ae1963672c6c9584b20bf05b77d14b7f823b972514e3620a3e5a355c302632c6747eep_bytes: 558bec6aff68e810450068acd9440064timestamp: 2001-08-01 22:54:42
Version Info:
CompanyName: Ilxdhlunh YycvbcxpyhmFileDescription: Jqbblwvdb ODBC Desktop Driver Pack 3.5FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)InternalName: odbcji32.dllLegalCopyright: © Ddpjkricr Rmczqqqdhzs. All rights reserved.OriginalFilename: odbcji32.dllProductName: Microsoft® Rntordq® Tnwrptaup GquqmnProductVersion: 6.1.7600.16385Translation: 0x0409 0x04b0

Win32:Kryptik-AZJ [Trj] also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Monder.lic2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zbot.34
ClamAV	Win.Trojan.Pirminay-664
ALYac	Gen:Variant.Zbot.34
Cylance	Unsafe
Zillya	Trojan.Pirminay.Win32.651
Sangfor	Suspicious.Win32.Save.ins
Alibaba	Trojan:Win32/Starter.ali2000005
Cybereason	malicious.0cdf17
VirIT	Trojan.Win32.Generic.BFFY
ESET-NOD32	a variant of Win32/Ponmocup.GA
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Zbot.34
NANO-Antivirus	Trojan.Win32.Crypted.kfpqp
Avast	Win32:Kryptik-AZJ [Trj]
Tencent	Win32.Trojan.Generic.Zolw
Ad-Aware	Gen:Variant.Zbot.34
TACHYON	Trojan/W32.Pirminay.345629
Emsisoft	Gen:Variant.Zbot.34 (B)
Comodo	Malware@#202gc2hjyn69m
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.DownLoader5.52436
VIPRE	Gen:Variant.Zbot.34
McAfee-GW-Edition	Generic Malware.ms
FireEye	Generic.mg.e99be4c0cdf17b33
Sophos	ML/PE-A + Mal/Ponmocup-A
Ikarus	Trojan.Win32.Pirminay
GData	Gen:Variant.Zbot.34
Jiangmin	Trojan/Pirminay.ou
Webroot	W32.Trojan.Gen
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Win32.Pirminay
Kingsoft	Win32.Troj.Pirminay.av.(kcloud)
Arcabit	Trojan.Zbot.34
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	TrojanDownloader:Win32/Ponmocup.A
Google	Detected
McAfee	Generic Malware.ms
VBA32	BScope.TrojanDownloader.Ponmocup
Rising	Malware.Undefined!8.C (TFE:5:nTKfClGh9NS)
Yandex	Trojan.Kryptik!L2AlFtsnFBU
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.1912437.susgen
Fortinet	W32/Kryptik.ANL!tr
BitDefenderTheta	Gen:NN.ZexaF.34698.vq1@aSrt2Pfi
AVG	Win32:Kryptik-AZJ [Trj]
Panda	Generic Malware
CrowdStrike	win/malicious_confidence_100% (W)