| K7 Detection Name | Affected OS | Prevalence | AV Definition Version |
|---|---|---|---|
| Trojan ( 005b7a9a1 ) | Windows | Low | 12.198.53812 |
| MD5 | 8939440ef0bb18699f3884df10f5a646 |
| SHA256 | 2bde35928ec422774c5e6d0cf66924c8e9d351ae23f591aa03363ee34350069e |
| File Size | 14,663,168 bytes |
| Packer Information | N/A |
| First Seen | 07-11-2024 |
| Last Seen | 20-11-2024 |
| Aliases | Win64/GenKryptik.GZFK |
Behavior Details
1. Dropped files:
printui.exe
printui.dll
Under the folder
C:\Windows \System32
2. Dropped files:
Windows PowerShell.lnk
Under the folder
C:\Users\<user_name>\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell
3. Dropped files:
FTMH1UE0R0ES5PFAMVNC.temp
590aee7bdd69b59b.customDestinations-ms~RF6222e0.TMP
QC4ML1MALLQNZ2PXCMFF.temp
590aee7bdd69b59b.customDestinations-ms~RF6203ec.TMP
Under the folder
C:\Users\<user_name>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations
4. Dropped files:
backup_f64.exe
Under the folder
C:\Windows\sysnative
5. Creates Registry:
Adds registry data
\x00\x00\x00
Under the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\DcomLaunch
Removal Instructions
1. Update the copy of K7 security to the latest version.
2. Scan the system completely and remove the detected files.
3. Open Windows registry editor.
4. Delete the registry data
\x00\x00\x00
Under the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\DcomLaunch
5. Close the Windows registry.
6. Restart the machine.