About “Backdoor:MSIL/Sisbot!rfn” infection

The Backdoor:MSIL/Sisbot!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:MSIL/Sisbot!rfn virus can do?

Sample contains Overlay data
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Backdoor:MSIL/Sisbot!rfn?


File Info:
name: C26F418F4D833D43DA60.mlw
path: /opt/CAPEv2/storage/binaries/08947141a716b1c9e8848bb20f6f79519145c13e537bd34d33c7065878e09d86
crc32: 4CEA9A1B
md5: c26f418f4d833d43da60eacdb9530842
sha1: daaaefb32716e0e45093adfae314224dfebd85f2
sha256: 08947141a716b1c9e8848bb20f6f79519145c13e537bd34d33c7065878e09d86
sha512: 56423dfd7454a2a9fc3f8233eae6e2c486604c6f6a7fb77b7577a9f8fbe7e72bbf7b6837a7c03170fa4f6c38c0db2ff5f569e46cc3cdf08e22f8d0e70d7dcbd3
ssdeep: 12288:vVK5pCy1dZZMWwNHnSat5ZfjAHwK1ZJ1OSo9OIOhWfw3kWpbPyn/0eHLnA:WB1zZdwNHnSufMkSnIi3k+PynMaA
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T152153B103794EA1ED1FF4A34D875482903F0E2063665EBAA5BA0F19E3C93F819D653B7
sha3_384: 1cf636ee3fac93b5a39d3d6bc9dd618be52aa814ae9a938dbfad97724c4a931245436c5c605c4dedce44732750ac3d40
ep_bytes: ff250020400000000000000000000000
timestamp: 2012-01-03 16:25:37

Version Info:
Translation: 0x0000 0x04b0
Comments: C# implementation of the MSN protocol
CompanyName: MSNPSharp
FileDescription: MSNPSharp MSN Protocol Library
FileVersion: 5.0.0.2717
InternalName: MSNPSharp.dll
LegalCopyright: Copyright (c) 2002-2012, Bas Geertsema, Xih Solutions (http://www.xihsolutions.net), Thiago.Sayao, Pang Wu, Ethem Evlice, Andy Phan, Chang Liu. 
LegalTrademarks: MSNPSharp
OriginalFilename: MSNPSharp.dll
ProductName: MSNPSharp
ProductVersion: 5.0.0.2717
Assembly Version: 5.0.0.2717

Backdoor:MSIL/Sisbot!rfn also known as:

Lionic	Trojan.Win32.Generic.4!c
Skyhigh	GenericRXKP-WC!C26F418F4D83
McAfee	GenericRXKP-WC!C26F418F4D83
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0006fb3d1 )
Alibaba	Trojan:MSIL/GenMalicious.ef19e868
K7GW	Trojan ( 0006fb3d1 )
CrowdStrike	win/malicious_confidence_100% (D)
VirIT	Trojan.Win32.Generic.CLKT
Symantec	Trojan.Gen.2
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.P
Cynet	Malicious (score: 99)
ClamAV	Win.Ircbot.Generickdz-9843485-0
Avast	Win32:GenMalicious-HFG [Trj]
Baidu	MSIL.Worm.Autorun.a
F-Secure	Heuristic.HEUR/AGEN.1301059
DrWeb	Trojan.DownLoader11.38676
Sophos	W32/MSIL-QUY
Ikarus	Backdoor.MSIL.Sisbot
Jiangmin	Trojan.Generic.fgwg
Varist	W32/MSIL_Agent.DBY.gen!Eldorado
Avira	HEUR/AGEN.1301059
Antiy-AVL	Trojan/Win32.TSGeneric
Kingsoft	malware.kb.c.983
Microsoft	Backdoor:MSIL/Sisbot!rfn
Google	Detected
AhnLab-V3	Trojan/Win32.Sisbot.C2828433
VBA32	TScope.Trojan.MSIL
Malwarebytes	Generic.Malware.AI.DDS
Rising	Backdoor.Sisbot!1.A305 (CLASSIC)
Yandex	Trojan.DownLoader!xNwCpzLagRY
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/GenMalicious.HFG!tr
AVG	Win32:GenMalicious-HFG [Trj]
DeepInstinct	MALICIOUS

How to remove Backdoor:MSIL/Sisbot!rfn?

Backdoor:MSIL/Sisbot!rfn removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X