Should I remove "MSIL/Filecoder.AFT"?

The MSIL/Filecoder.AFT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Filecoder.AFT virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Detects Sandboxie through the presence of a library
Checks for the presence of known windows from debuggers and forensic tools
Tries to unhook or modify Windows functions monitored by Cuckoo
Network activity detected but not expressed in API logs
Checks the version of Bios, possibly for anti-virtualization
Detects VirtualBox through the presence of a registry key
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine MSIL/Filecoder.AFT?


File Info:
crc32: 2DC6FADF
md5: 79b1f7134431990420b7827905e05e30
name: 79B1F7134431990420B7827905E05E30.mlw
sha1: b8003dd6781b169bd3c07a920d4c72f06eef1c3a
sha256: a09ce48399c1819d7f6f78cebe566fdb7ef54e80a567110aa54c8142d6e1d5c2
sha512: 70315147c908212de8a7d254a15a2ba95e346eb90269c12f519ae8a5c58450258c7f2c2de22d6782ae0d45b8ec7a97c7617158966b53ef097008db2e2ce4f408
ssdeep: 49152:2tCNJafnI0Xtj51omykFKpPXgNzFcVe82sSmE7bWsRk8mb3/uDxG:2lfIofywKe82sSnPWs9pw
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2021
Assembly Version: 1.0.0.0
InternalName: LegionLocker2.1.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: LegionLocker2.1
ProductVersion: 1.0.0.0
FileDescription: LegionLocker2.1
OriginalFilename: LegionLocker2.1.exe

MSIL/Filecoder.AFT also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 0057b6f11 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Encoder.33881
Cynet	Malicious (score: 100)
ALYac	Trojan.Ransom.Filecoder
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/Witch.38da2831
K7GW	Trojan ( 0057b6f11 )
Cybereason	malicious.6781b1
Cyren	W32/Agent.CUB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Filecoder.AFT
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan.Win32.Witch.chd
BitDefender	Trojan.GenericKD.36821501
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
MicroWorld-eScan	Trojan.GenericKD.36821501
Tencent	Win32.Trojan.Witch.Akfh
Ad-Aware	Trojan.GenericKD.36821501
Sophos	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZexaF.34688.0E0@a0sqj4ji
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R067C0WE321
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.vc
FireEye	Generic.mg.79b1f71344319904
Emsisoft	Trojan.GenericKD.36821501 (B)
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1135447
eGambit	Unsafe.AI_Score_99%
Kingsoft	Win32.Troj.Generic.a.(kcloud)
Microsoft	Ransom:MacOS/Filecoder
Gridinsoft	Trojan.Heur!.032100A1
GData	Trojan.GenericKD.36821501
AhnLab-V3	Ransomware/Win.Legion.C4447432
McAfee	Artemis!79B1F7134431
MAX	malware (ai score=83)
VBA32	BScope.Trojan.Fuerboos
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R067C0WE321
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazr/V1xZGo6cazXdJH9fqn3Y)
Ikarus	Trojan.Win32.Themida
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove MSIL/Filecoder.AFT?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Should I remove “MSIL/Filecoder.AFT”?