Backdoor.MSIL.Crysan.aac (file analysis)

The Backdoor.MSIL.Crysan.aac is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor.MSIL.Crysan.aac virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Backdoor.MSIL.Crysan.aac?


File Info:
crc32: B490B44B
md5: 764ef2769b629f5db6c26c4e3126b809
name: 764EF2769B629F5DB6C26C4E3126B809.mlw
sha1: 8647939a8203716eb97a7c9f96e265ba76491153
sha256: 6412e50a2a917f37b09730c975d7dbc1ccebc48442196b74d7cf694e19a093c7
sha512: a7634c48b6b4694fe419d58adf7ffc7c529b125806707e5d4e29df94db5a116c824337a666da6fd8445aafe2950ab39522efed1950c055d562af516581214909
ssdeep: 6144:gDKW1Lgbdl0TBBvjc/NjZ/dc3fICY/Co/yh2:mh1Lk70Tnvjc5Z/UQCAhK2
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
Assembly Version: 6.2.10240.16384
InternalName: svchost.exe
FileVersion: 6.2.10240.16384
CompanyName: Microsoft Corporation
LegalTrademarks: 
Comments: 
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.2.10240.16384
FileDescription: Host Process for Windows Services
OriginalFilename: svchost.exe

Backdoor.MSIL.Crysan.aac also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 00564e161 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Ransom.Genasom.S1302864
McAfee	Artemis!764EF2769B62
Cylance	Unsafe
Zillya	Backdoor.Crysan.Win32.549
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	Backdoor:MSIL/Crysan.8eb2cb6a
K7GW	Trojan ( 00564e161 )
Cybereason	malicious.69b629
Cyren	W32/Trojan.DAN.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Agent.CQS
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Backdoor.MSIL.Crysan.aac
BitDefender	Gen:Variant.Ransom.Fantom.4
NANO-Antivirus	Trojan.Win32.Crysan.hnjdjm
MicroWorld-eScan	Gen:Variant.Ransom.Fantom.4
Tencent	Msil.Backdoor.Crysan.Agli
Ad-Aware	Gen:Variant.Ransom.Fantom.4
Sophos	Mal/Generic-S
Comodo	Malware@#24pdp7savd8qb
BitDefenderTheta	Gen:NN.ZexaF.34722.oq0@aWPOfkd
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.764ef2769b629f5d
Emsisoft	Gen:Variant.Ransom.Fantom.4 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/ATRAPS.Gen
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.3093772
Microsoft	Backdoor:Win32/Bladabindi!ml
Arcabit	Trojan.Ransom.Fantom.4
GData	Gen:Variant.Ransom.Fantom.4
AhnLab-V3	Trojan/Win32.Generic.C2888262
Acronis	suspicious
VBA32	Backdoor.MSIL.Crysan
MAX	malware (ai score=80)
Rising	Trojan.Generic@ML.100 (RDML:mHl8H4MEixlwnA780X4POQ)
Ikarus	Trojan.MSIL.Agent
Fortinet	W32/Crysan.AAC!tr.bdr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Backdoor.MSIL.Crysan.aac?

Backdoor.MSIL.Crysan.aac removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X