MSIL/GenKryptik.GSAU removal instruction

The MSIL/GenKryptik.GSAU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/GenKryptik.GSAU virus can do?

CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/GenKryptik.GSAU?


File Info:
name: E935E578FC9C3F2EB8EB.mlw
path: /opt/CAPEv2/storage/binaries/c3509aae7603690ed7a902f1d9b12ef6c2a9ba1909dbefc61d74372041be75c6
crc32: C589702E
md5: e935e578fc9c3f2eb8eb3cf3ae0e1d8e
sha1: 7f61dd4a9f7b98d811238a2a7773fa4c18a086c1
sha256: c3509aae7603690ed7a902f1d9b12ef6c2a9ba1909dbefc61d74372041be75c6
sha512: e21471b4b703e7a3128c8703a02b0c6dfb37059bca5d12237cb16f4ba738735921ac87f6cb09d393538c2cd7c628196b320a6079a95e5dac932d6f0ddb10e432
ssdeep: 12288:ViWaKIjXq45YavjhJXhV31L3dUOo//P1x2UKwI6ckkmDfT:YWaKIhYavJhxNUOo/D2II60mrT
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T109D42357218CAF27C5F987FAC445859A02F3D63A0D11C24F2ECF25EA1B2AF0917266D7
sha3_384: 4ebf8e8305df3affae103dc94117ca2daeb98ed2eb68e247914d6f5028f44f11c61126e4d421f502f2e6bb0f83909d59
ep_bytes: ff250020400035353434465347594130
timestamp: 2023-12-29 02:40:52

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: Events ORG
FileDescription: Check Car
FileVersion: 0.0.0.0
InternalName: Aeemw.exe
LegalCopyright: Copyright ©  2017
LegalTrademarks: 
OriginalFilename: Aeemw.exe
ProductName: Check Car
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

MSIL/GenKryptik.GSAU also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Agensla.i!c
MicroWorld-eScan	Trojan.GenericKD.71017083
FireEye	Trojan.GenericKD.71017083
Skyhigh	BehavesLike.Win32.Generic.jc
ALYac	Trojan.GenericKD.71017083
Cylance	unsafe
Sangfor	Infostealer.Msil.AgentTesla.Vm7f
Alibaba	TrojanPSW:MSIL/Agensla.65a65637
Cybereason	malicious.a9f7b9
Arcabit	Trojan.Generic.D43BA27B
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Scr.Malcode!gdn33
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.GSAU
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.GenericKD.71017083
Avast	Win32:PWSX-gen [Trj]
Sophos	Troj/Krypt-ABH
VIPRE	Trojan.GenericKD.71017083
Emsisoft	Trojan.GenericKD.71017083 (B)
Varist	W32/MSIL_Kryptik.KIE.gen!Eldorado
Microsoft	Trojan:Win32/AgentTesla!ml
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Trojan.GenericKD.71017083
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5569052
McAfee	Artemis!E935E578FC9C
MAX	malware (ai score=86)
VBA32	TrojanLoader.MSIL.DaVinci.Heur
Malwarebytes	Trojan.MalPack.PNG.Generic
TrendMicro-HouseCall	TROJ_GEN.F0D1C00LT23
Rising	Malware.Obfus/MSIL@AI.98 (RDM.MSIL2:D3Whlag2yNvwdaLJA/t3HA)
Yandex	Trojan.Igent.b1tCCl.1
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.PWSX!tr
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove MSIL/GenKryptik.GSAU?

MSIL/GenKryptik.GSAU removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X