Win32:MalOb-KT [Cryp] (file analysis)

The Win32:MalOb-KT [Cryp] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:MalOb-KT [Cryp] virus can do?

Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32:MalOb-KT [Cryp]?


File Info:
name: 6FEBC0F3F0A8185D33BA.mlw
path: /opt/CAPEv2/storage/binaries/0fb1d9470859291d395e6c42d97f51c77333c83b258ac6d76349f8bf1122de8b
crc32: 64B6D2C9
md5: 6febc0f3f0a8185d33ba2a4e773ce675
sha1: 7ad00ca07d364e953c689c06e9ce86cae57bf898
sha256: 0fb1d9470859291d395e6c42d97f51c77333c83b258ac6d76349f8bf1122de8b
sha512: 0a9f44c43b87a008f0a86c42d0cb21513cab56ecdcd06278aeb929b751200955d6979882fa26f7d177ab6571e0b93714b2a11ff20e960dead66dd3403d685eff
ssdeep: 768:TKkPfMuYgIb1aAMUx1hvbr6Sw7weOXpmD2gsEA7Nqnh:5UuLARdr7NeXD2XEIYh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T114844A01BE81E473D21529355E86C7F09B7AB963AEA5544B3FC8037F8F312D08A36755
sha3_384: 1fbfd688967d59ab8390bbc2897ba94937e11e206c24d4440fb3c29f670989d347d682c269ae25095ca3ecfed8f21a86
ep_bytes: e8cf7c0000e979feffffcccccccccccc
timestamp: 2014-09-16 13:20:11

Version Info:
0: [No Data]

Win32:MalOb-KT [Cryp] also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (moderate confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.6febc0f3f0a8185d
CAT-QuickHeal	Trojan.Agent
Skyhigh	Artemis!Trojan
Cylance	unsafe
Sangfor	Trojan.Win32.Agent.Vcqy
CrowdStrike	win/malicious_confidence_70% (W)
APEX	Malicious
Avast	Win32:MalOb-KT [Cryp]
F-Secure	Trojan.TR/Crypt.XPACK.Gen
SentinelOne	Static AI – Suspicious PE
Google	Detected
Avira	TR/Crypt.XPACK.Gen
Microsoft	PUA:Win32/Caypnamer.A!ml
GData	Win32.Trojan.Agent.9FRBMT
McAfee	Artemis!6FEBC0F3F0A8
Malwarebytes	Generic.Malware/Suspicious
Ikarus	Packer.Win32.Tdss
Fortinet	W32/PossibleThreat
AVG	Win32:MalOb-KT [Cryp]
DeepInstinct	MALICIOUS

How to remove Win32:MalOb-KT [Cryp]?

Win32:MalOb-KT [Cryp] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X