About “MSIL/Agent.WAS” infection

The MSIL/Agent.WAS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Agent.WAS virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine MSIL/Agent.WAS?


File Info:
name: 4722467960AA102B1D9F.mlw
path: /opt/CAPEv2/storage/binaries/3f3637e3aa752bb9aae55b4dc1e9005dc3c6bba7cc7eef7ef9bd32b751ab25ee
crc32: E55364D3
md5: 4722467960aa102b1d9f05bc9ac4e868
sha1: 4437437b60af64a024d1484dfad2b38693fa0e7c
sha256: 3f3637e3aa752bb9aae55b4dc1e9005dc3c6bba7cc7eef7ef9bd32b751ab25ee
sha512: 622a686f401d54f063dfdfd2df44d0e2fedee02400147e4e93f361a80ee0ec91754e1ae436dcf0eadbd3f5c8dc65f05633f39270dd670e46f7b6bb8df30ca64e
ssdeep: 192:YnLqSE8n+/VynlYJLLLTDs/B6I/kQJWOAR2iw8SBS2:YnLqSEt/xPLTc6hio9wT82
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A432C72113A24372CF7707B248832B44D670DA4859AFEF9F58E4B3765AF72C80B22532
sha3_384: 692f1234fc5108f538865a04e00d8f6c27cdc49ac0a08a2fd1642398040aaa2ac4c9488db504b43cb774b0e65b654528
ep_bytes: ff250020400000000000000000000000
timestamp: 2012-06-27 07:57:10

Version Info:
Translation: 0x0000 0x04b0
Comments: (本产品基于Foxtable设计)
CompanyName: 辉鹏软件工作室
FileDescription:  
FileVersion: 1.0.0.0
InternalName: 仓管系统.exe
LegalCopyright: pyh6918@163.com
OriginalFilename: 仓管系统.exe
ProductName: 辉鹏仓库管理系统
ProductVersion: 1.0.0.0
Assembly Version: 2.0.6.3

MSIL/Agent.WAS also known as:

FireEye	Generic.mg.4722467960aa102b
McAfee	Artemis!4722467960AA
Cylance	unsafe
CrowdStrike	win/malicious_confidence_70% (W)
Cyren	W32/MSIL_Agent.EYX.gen!Eldorado
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of MSIL/Agent.WAS
APEX	Malicious
Ikarus	Trojan.Crypter
Antiy-AVL	Trojan/MSIL.Agent
Google	Detected
Malwarebytes	Generic.Malware/Suspicious
Rising	Trojan.Agent!8.B1E (CLOUD)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.WAS!tr
DeepInstinct	MALICIOUS

How to remove MSIL/Agent.WAS?

MSIL/Agent.WAS removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X