Backdoor:MSIL/Crysan.ASGC!MTB removal

The Backdoor:MSIL/Crysan.ASGC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:MSIL/Crysan.ASGC!MTB virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
CAPE detected the zgRAT malware family
Binary file triggered YARA rule
Binary compilation timestomping detected

How to determine Backdoor:MSIL/Crysan.ASGC!MTB?


File Info:
name: C84135EB2C88279DBEF6.mlw
path: /opt/CAPEv2/storage/binaries/1688879a49a13fa103b924793d603a6e52491da39175968f8af7ca3dc6d39a38
crc32: DCD1D832
md5: c84135eb2c88279dbef6e1425e88df45
sha1: 2ef919a81f43c948752fbe2a5d17cc662dfca326
sha256: 1688879a49a13fa103b924793d603a6e52491da39175968f8af7ca3dc6d39a38
sha512: 489acc42f7a48052c13b0cd830c649b5bfb118d172afe888623d6847005d2ff8308e03f7c52868d12a870d70b7d9b9d6c091cfd6123b58661410bb41661808a4
ssdeep: 3072:UNFnjvjaAdJjSWeq76srPipvAZY49W5E+jl35U1an:UNdjvjaM3+pIZ3WVS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19A046C1E2785CB22E33D0AB8E0F6012443B692832723E76B7FD558F21F5339759856AD
sha3_384: 918e15344ab70422afdee4968c06eac883aeca548595d342f85a7046b4eb89a4dcd81af91183281694b5209243485421
ep_bytes: ff250020400000000000000000000000
timestamp: 2043-01-20 16:36:53

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: Stub.exe
LegalCopyright: Copyright ©  2019
LegalTrademarks: 
riginalFilename: Stub.exe
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Backdoor:MSIL/Crysan.ASGC!MTB also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Crysan.m!c
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.5615
Skyhigh	Artemis!Trojan
McAfee	Artemis!C84135EB2C88
Cylance	unsafe
Zillya	Backdoor.Crysan.Win32.7100
Sangfor	Suspicious.Win32.Save.a
Alibaba	Backdoor:MSIL/Crysan.28f6f9cd
Cybereason	malicious.b2c882
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/Agent.BYE
APEX	Malicious
ClamAV	Win.Packed.Lazy-10016677-0
Kaspersky	Backdoor.MSIL.Crysan.hzo
BitDefender	IL:Trojan.MSILZilla.5615
Avast	Win32:MalwareX-gen [Trj]
Tencent	Malware.Win32.Gencirc.10bf6595
TACHYON	Backdoor/W32.DN-Crysan.177664.B
Emsisoft	IL:Trojan.MSILZilla.5615 (B)
F-Secure	Heuristic.HEUR/AGEN.1372444
VIPRE	IL:Trojan.MSILZilla.5615
FireEye	Generic.mg.c84135eb2c88279d
Sophos	Troj/AsyncRat-F
Ikarus	Trojan.MSIL.Agent
Jiangmin	Backdoor.MSIL.giga
Google	Detected
Avira	HEUR/AGEN.1372444
Varist	W32/MSILZilla.F.gen!Eldorado
Antiy-AVL	Trojan[Backdoor]/Win32.Bladabindi
Kingsoft	malware.kb.c.770
Microsoft	Backdoor:MSIL/Crysan.ASGC!MTB
Arcabit	IL:Trojan.MSILZilla.D15EF
ZoneAlarm	Backdoor.MSIL.Crysan.hzo
GData	IL:Trojan.MSILZilla.5615
AhnLab-V3	Trojan/Win.MSILZilla.R626088
VBA32	Trojan.MSIL.Buts.gen
ALYac	IL:Trojan.MSILZilla.5615
MAX	malware (ai score=89)
Malwarebytes	Trojan.Crypt.MSIL
Panda	Trj/GdSda.A
Rising	Malware.Obfus/MSIL@AI.96 (RDM.MSIL2:+bgFcWx7q6y6vAw3YKyrIw)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.219894357.susgen
Fortinet	MSIL/Zusy.5192!tr
BitDefenderTheta	Gen:NN.ZemsilF.36802.km0@ayg7rCp
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Backdoor:MSIL/Crysan.ASGC!MTB?

Backdoor:MSIL/Crysan.ASGC!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X