CryptTool.Agent.MSIL malicious file

The CryptTool.Agent.MSIL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What CryptTool.Agent.MSIL virus can do?

Dynamic (imported) function loading detected
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine CryptTool.Agent.MSIL?


File Info:
name: C4B4B3E9826FED8115D8.mlw
path: /opt/CAPEv2/storage/binaries/60d308b1da62fcc2f878a1c9f27a5dfd8d892e4eefc69cbee93a318531cf8726
crc32: DD0356ED
md5: c4b4b3e9826fed8115d84206689d4deb
sha1: 189da38630fc1753d0d927e951987d013e0b41ca
sha256: 60d308b1da62fcc2f878a1c9f27a5dfd8d892e4eefc69cbee93a318531cf8726
sha512: b012ddb1d5892b4728ef24bb321a4e992c942741c7b60aa71116b4f00d6fb8de4df4d676ba0f59fcaed05763653ce717889eae6135f3bc0f38c8927772f33790
ssdeep: 49152:5Kuq7zI1W7TDbxp7151JSQlVMKyEXxKGrixcy0Kq2WSI:5fOzI1WDbx7JOvOxKGraV0v7SI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D0A5230918DDCC2DC7C48936B6F7D25EA23915967D1669077F0A2C9E6F34BCCACDA088
sha3_384: 3315501fd7da39d27d6df17d993de20f876a5c56175c58e5065e295d67ab495971c98898cd5d0d3e0ddf0591fbc7ed57
ep_bytes: ff250020400000000000000000000000
timestamp: 2079-01-03 05:57:54

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: WindowsFormsApp1
FileVersion: 1.0.0.0
InternalName: Crypter.exe
LegalCopyright: Copyright ©  2020
LegalTrademarks: 
OriginalFilename: Crypter.exe
ProductName: WindowsFormsApp1
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

CryptTool.Agent.MSIL also known as:

Lionic	Trojan.Win32.Razy.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.817783
FireEye	Gen:Variant.Razy.817783
McAfee	GenericRXAA-FA!C4B4B3E9826F
Zillya	Tool.Crypter.Win32.3212
K7AntiVirus	Riskware ( 0057de561 )
BitDefender	Gen:Variant.Razy.817783
K7GW	Riskware ( 0057de561 )
Cybereason	malicious.9826fe
BitDefenderTheta	Gen:NN.ZemsilF.34084.co0@aycFEDi
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Riskware.Crypter.VC
TrendMicro-HouseCall	TROJ_GEN.R002H09KM21
Ad-Aware	Gen:Variant.Razy.817783
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
SentinelOne	Static AI – Suspicious PE
Emsisoft	Gen:Variant.Razy.817783 (B)
APEX	Malicious
Avira	HEUR/AGEN.1144273
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Generic.ASMalwS.316BDE0
Microsoft	Trojan:Win32/Woreflint.A!cl
GData	Gen:Variant.Razy.817783
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win32.Generic.C4380524
ALYac	Gen:Variant.Razy.817783
Malwarebytes	CryptTool.Agent.MSIL
Tencent	Win32.Trojan.Razy.Szbg
Fortinet	Riskware/Crypter
AVG	Win32:CrypterX-gen [Trj]
Avast	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove CryptTool.Agent.MSIL?

CryptTool.Agent.MSIL removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X