Backdoor

Backdoor.MSIL.Crysan.cpi information

Malware Removal

The Backdoor.MSIL.Crysan.cpi is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor.MSIL.Crysan.cpi virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Possible date expiration check, exits too soon after checking local time
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • Checks for the presence of known windows from debuggers and forensic tools
  • Network activity detected but not expressed in API logs
  • Checks for the presence of known devices from debuggers and forensic tools
  • Anomalous binary characteristics

How to determine Backdoor.MSIL.Crysan.cpi?


File Info:

crc32: B0A09EB6
md5: b7ee27b3f5e44ed3c87b298c0511c7b6
name: B7EE27B3F5E44ED3C87B298C0511C7B6.mlw
sha1: e168aefaa7302a0b49ea40a6d5e01ca2d0480938
sha256: 678b3119ad3c2d5596d32069b4edce2986b793506d1501fe36922c016e7075d3
sha512: d97d015a942e0201b59a4090385b811342219bf4f856d33fcf74aff97ca27ee8a77d9eef34aa32bfb4579eda54aedf794c947f470d905bf0080fc6b9aea7ff63
ssdeep: 24576:+GUSUpfP2usYo4PWXivJLdpkzHbyWlZcQTuVH2ReBnHLb6N:3UpHo4Pyi70ZlZ16Nf
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0000 0x04b0
LegalCopyright:
Assembly Version: 1.0.0.0
InternalName: Stub.exe
FileVersion: 1.0.0.0
CompanyName:
LegalTrademarks:
Comments:
ProductName:
ProductVersion: 1.0.0.0
FileDescription:
OriginalFilename: Stub.exe

Backdoor.MSIL.Crysan.cpi also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
ALYacGen:Variant.Ursu.112022
CylanceUnsafe
CrowdStrikewin/malicious_confidence_80% (W)
K7GWTrojan ( 0055f2201 )
K7AntiVirusTrojan ( 0055f2201 )
CyrenW32/Trojan.FFG.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.Enigma.DS
ZonerProbably Heur.ExeHeaderH
APEXMalicious
AvastWin32:RATX-gen [Trj]
CynetMalicious (score: 100)
KasperskyBackdoor.MSIL.Crysan.cpi
BitDefenderGen:Variant.Ursu.112022
MicroWorld-eScanGen:Variant.Ursu.112022
Ad-AwareGen:Variant.Ursu.112022
SophosMal/Generic-S
BitDefenderThetaGen:NN.ZexaF.34170.iz0@a4fGwuf
McAfee-GW-EditionBehavesLike.Win32.Generic.tc
FireEyeGeneric.mg.b7ee27b3f5e44ed3
EmsisoftGen:Variant.Ursu.112022 (B)
SentinelOneStatic AI – Malicious PE
AviraHEUR/AGEN.1137410
KingsoftWin32.Heur.KVMH015.a.(kcloud)
MicrosoftTrojan:Win32/Woreflint.A!cl
ArcabitTrojan.Ursu.D1B596
ZoneAlarmBackdoor.MSIL.Crysan.cpi
GDataMSIL.Backdoor.ASyncRAT.WYA4AT
AhnLab-V3Trojan/Win32.Packed.R355835
Acronissuspicious
McAfeeArtemis!B7EE27B3F5E4
MAXmalware (ai score=85)
VBA32Trojan.Zpevdo
TrendMicro-HouseCallTROJ_GEN.R014H0CIJ21
RisingPUF.Pack-Enigma!1.BA33 (CLASSIC)
IkarusPUA.Packed.Enigma
MaxSecureTrojan.Malware.300983.susgen
FortinetRiskware/Application
AVGWin32:RATX-gen [Trj]
Paloaltogeneric.ml

How to remove Backdoor.MSIL.Crysan.cpi?

Backdoor.MSIL.Crysan.cpi removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment