MSIL/Filecoder.Chaos.A removal guide

The MSIL/Filecoder.Chaos.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Filecoder.Chaos.A virus can do?

Authenticode signature is invalid
Anomalous .NET characteristics
CAPE detected the Chaos malware family

How to determine MSIL/Filecoder.Chaos.A?


File Info:
name: 7051DCBE9A0837A312B0.mlw
path: /opt/CAPEv2/storage/binaries/ce750c7054359e9e88556d48f7eea341374b74f494caed48251185b54c9ed644
crc32: 610691FA
md5: 7051dcbe9a0837a312b09a5ae3b42430
sha1: 3553ff8725a57929e438228bf141b695c13cecb4
sha256: ce750c7054359e9e88556d48f7eea341374b74f494caed48251185b54c9ed644
sha512: 2e82160bff1fbdd6f6a9f0210dfaf831650fdefdf8e3bb70c3c2717122b107ef3610c5c5f55908843df7ba3bd3bbefc40b9d1dda07877083cbd2ab8b090a276c
ssdeep: 1536:Zo2eMtPr9b/u+hCnbKeg7hISAv8Iz/xYnPCiPlNE927Zk5L+:Zo5MtPr9b/u+yoza/xYPCSc27ZIL+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T197836E243AFF5029F273AEB95FE0B59ACE6EF6333A0B90591091034A4723D81DD91539
sha3_384: b6323d32d150cd64f5f94eb0de886c8087774bfda7a8f3d8362669d7a2423486b6247fb09ec8081fc2ddba8268a85875
ep_bytes: ff250020400000000000000000000000
timestamp: 2024-02-10 03:10:59

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: shout.exe
LegalCopyright:  
OriginalFilename: shout.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

MSIL/Filecoder.Chaos.A also known as:

Bkav	W32.AIDetectMalware.CS
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.Ransom.Imps.3
FireEye	Generic.mg.7051dcbe9a0837a3
CAT-QuickHeal	Trojan.MsilFC.S23210427
Skyhigh	BehavesLike.Win32.Generic.mt
McAfee	GenericRXPW-PH!7051DCBE9A08
Cylance	unsafe
Sangfor	Ransom.Win32.Save.a
K7AntiVirus	Ransomware ( 005a8b921 )
K7GW	Ransomware ( 005a8b921 )
Cybereason	malicious.725a57
BitDefenderTheta	AI:Packer.0EC7AB801F
Symantec	Ransom.Sorry
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/Filecoder.Chaos.A
APEX	Malicious
ClamAV	Win.Ransomware.Hydracrypt-9878672-0
Kaspersky	HEUR:Trojan-Ransom.MSIL.Agent.gen
BitDefender	Gen:Heur.Ransom.Imps.3
Avast	Win32:RansomX-gen [Ransom]
Sophos	Troj/Ransom-GWT
F-Secure	Heuristic.HEUR/AGEN.1305617
DrWeb	Trojan.Encoder.34437
TrendMicro	Ransom.MSIL.CHAOS.SMRA14
Emsisoft	Gen:Heur.Ransom.Imps.3 (B)
SentinelOne	Static AI – Malicious PE
GData	MSIL.Trojan-Ransom.Remind.B
Google	Detected
Avira	HEUR/AGEN.1305617
Varist	W32/Azorult.D.gen!Eldorado
Kingsoft	malware.kb.c.1000
Arcabit	Trojan.Ransom.Imps.3
ZoneAlarm	HEUR:Trojan-Ransom.MSIL.Agent.gen
Microsoft	Ransom:MSIL/FileCoder.AD!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Ransomware/Win.FTD.C4580181
VBA32	Trojan.MSIL.DelShad.Heur
MAX	malware (ai score=88)
Malwarebytes	Generic.Malware.AI.DDS
Rising	Ransom.Destructor!1.B060 (CLASSIC)
Ikarus	Trojan-Ransom.FileCrypter
Fortinet	MSIL/Filecoder.8878!tr.ransom
AVG	Win32:RansomX-gen [Ransom]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove MSIL/Filecoder.Chaos.A?

MSIL/Filecoder.Chaos.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X