How to remove “MSIL/Agent.BEW”?

The MSIL/Agent.BEW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Agent.BEW virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
Anomalous binary characteristics
Binary compilation timestomping detected

How to determine MSIL/Agent.BEW?


File Info:
name: 5382CB30F923506FCA47.mlw
path: /opt/CAPEv2/storage/binaries/1513cbd3c24dd8901efbf4a45bd25f030e1d654e29c21e6b5632cf5e5413249b
crc32: 77A99AD2
md5: 5382cb30f923506fca4701b6a53015e4
sha1: b15e192c44b7d1dd9aae77a936c69f3323dfcc06
sha256: 1513cbd3c24dd8901efbf4a45bd25f030e1d654e29c21e6b5632cf5e5413249b
sha512: 470bae5c3d7dfc66f176c4390bede1a89face690b5ee286f5e305a31605464752fb332eb77e2189b765efddb1e2bc079ce3bd579e67a0ad6ae7481a6b3c39874
ssdeep: 384:N5uyeFbjKhXA7a9YV/LLmNXLIaN7hGB0JpLKL3oi9chHbNr9K:Ls+Wm9xbtWgH5r9K
type: PE32+ executable (console) x86-64, for MS Windows
tlsh: T122823B457BE88639FABD06B50D73DA209779C5C7D851EB0F09C8605A0F233844AA1EFB
sha3_384: 2d618ac7017a134003b9b2fd2bf4090c33932f30010e7cab3e16b5d7a7ccc4bbe582e96543e3689bb1fa5af557a0323b
ep_bytes: 4d5a90000300000004000000ffff0000
timestamp: 2058-04-06 20:40:22

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: WindowsFormsApp1
FileVersion: 1.0.0.0
InternalName: WindowsFormsApp1.exe
LegalCopyright: Copyright ©  2021
LegalTrademarks: 
OriginalFilename: WindowsFormsApp1.exe
ProductName: WindowsFormsApp1
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Agent.BEW also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Johnnie.261330
FireEye	Generic.mg.5382cb30f923506f
ALYac	Gen:Variant.Johnnie.261330
Cylance	Unsafe
K7AntiVirus	Trojan ( 0051c6271 )
K7GW	Trojan ( 0051c6271 )
CrowdStrike	win/malicious_confidence_90% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Agent.BEW
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.Revenge.gen
BitDefender	Gen:Variant.Johnnie.261330
Avast	Win64:BackdoorX-gen [Trj]
Tencent	Msil.Backdoor.Revenge.Suxm
Ad-Aware	Gen:Variant.Johnnie.261330
DrWeb	BackDoor.SpyBotNET.19
TrendMicro	TROJ_GEN.R014C0WL621
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Johnnie.261330 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Johnnie.261330
MAX	malware (ai score=89)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
McAfee	Artemis!5382CB30F923
TrendMicro-HouseCall	TROJ_GEN.R014C0WL621
Rising	Backdoor.Revetrat!1.C8D4 (CLASSIC)
Ikarus	Trojan.MSIL.Agent
eGambit	Unsafe.AI_Score_98%
Fortinet	MSIL/Agent.BEW!tr
AVG	Win64:BackdoorX-gen [Trj]
Cybereason	malicious.0f9235
MaxSecure	Trojan.Malware.300983.susgen

How to remove MSIL/Agent.BEW?

MSIL/Agent.BEW removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X