Categories: Malware

MSIL/Agent.SON removal tips

The MSIL/Agent.SON is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Agent.SON virus can do?

Reads data out of its own binary image
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous .NET characteristics
Detects Sunbelt Sandbox through the presence of a file
Checks the version of Bios, possibly for anti-virtualization
Checks the presence of disk drives in the registry, possibly for anti-virtualization
Detects VirtualBox through the presence of a file
Detects VirtualBox through the presence of a registry key
Detects VMware through the presence of a file
Detects VMware through the presence of a registry key

How to determine MSIL/Agent.SON?


File Info:
name: ABC21561D9852D75D8B3.mlwpath: /opt/CAPEv2/storage/binaries/5312772bb9832f47229bd3dd262bf6412780cfe907e5a8a96772c8cfcf685951crc32: 97B1A88Amd5: abc21561d9852d75d8b317e99936fcecsha1: d286d3767e34085c1b2df760e1d44d6cff85b8cfsha256: 5312772bb9832f47229bd3dd262bf6412780cfe907e5a8a96772c8cfcf685951sha512: ea15911d193858da297c3ee640ced12e4085481b1147b338b4f85b4ff0b868eb9c422621567493daeb7e7130fc4294a787ada8af1a13a66146f13e254c2abc54ssdeep: 3072:37zLK6xYiC/8bq6zT9qr30g/nX7AtaKWXSwfSV2g5:37/K6OBUbqqTo7BX7+UCYSV2g5type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B5E38D3C3BC89D11C16CA67E84D7920013B4DC756A52F36BBD88B2A95953FE58A02F4Fsha3_384: 40205eb5a6ca0c42430348501206ccdaa20feb66444f4565ade6859ca1891b689e9544d8f2dc883cfd7cf202b5958114ep_bytes: ff250020400000000000000000000000timestamp: 2018-06-10 21:21:47
Version Info:
0: [No Data]

MSIL/Agent.SON also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.4!c
tehtris	Generic.Malware
MicroWorld-eScan	Trojan.GenericKD.37139626
ALYac	Trojan.GenericKD.37139626
Cylance	Unsafe
VIPRE	Trojan.GenericKD.37139626
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005336781 )
Alibaba	Trojan:MSIL/Generic.fea309f5
K7GW	Trojan ( 005336781 )
Cybereason	malicious.67e340
Cyren	W32/MSIL_Troj.NF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.SON
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKD.37139626
Avast	Win32:TrojanX-gen [Trj]
Tencent	Win32.Trojan.Generic.Twhl
Ad-Aware	Trojan.GenericKD.37139626
Emsisoft	Trojan.GenericKD.37139626 (B)
Zillya	Trojan.Agent.Win32.2247703
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.abc21561d9852d75
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Trojan.GenericKD.37139626
Jiangmin	Trojan.Generic.cfuzp
Google	Detected
MAX	malware (ai score=86)
Antiy-AVL	Trojan/Generic.ASMalwS.3303
Kingsoft	Win32.Troj.Undef.(kcloud)
Arcabit	Trojan.Generic.D236B4AA
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4533558
McAfee	GenericRXDY-DM!ABC21561D985
Malwarebytes	Trojan.Crypt.MSIL.Generic
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:ZfYUyU98VmfFxyJzMq344w)
Yandex	Trojan.Agent!C3BCFlMxToo
Ikarus	Trojan.MSIL.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.SKA!tr
BitDefenderTheta	Gen:NN.ZemsilF.34754.jmW@aWiGyYo
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A