MSIL/Injector.QJC (file analysis)

The MSIL/Injector.QJC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Injector.QJC virus can do?

Executable code extraction
Creates RWX memory
At least one IP Address, Domain, or File Name was found in a crypto call
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Attempts to remove evidence of file being downloaded from the Internet
Exhibits behavior characteristic of Nanocore RAT
Collects information to fingerprint the system

Related domains:

tooblaq1.ddns.net

tooblaq2.ddns.net

How to determine MSIL/Injector.QJC?


File Info:
crc32: CCFE9809
md5: e5ffca5758d6e11c62094e37c00c8669
name: E5FFCA5758D6E11C62094E37C00C8669.mlw
sha1: 6ba36d22503a6b3fb93ef656d0b9bd62c7dc7959
sha256: f916e6dd1fe8838a0fecb15ff1be7c25b2c47e5fc43ebdb37bad5383e5ae1921
sha512: 5f78182d04bd29b8ea4a5b1681224f24fb400c8f5c0ba698edc0af41d7f643f71258d27c018fd9d0f5e1c8e387348d4360eaad8f8370806bc8348decc0021c26
ssdeep: 6144:HhZ7uy1ZZVwwjrJPUi1HnDRitp2tX0o22LIwJw2Ll+DxCaCg5NI:HPjZZV5dHDktEX1swijoaX
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2015
Assembly Version: 1.0.0.0
InternalName: two.exe
FileVersion: 1.0.0.0
ProductName: two
ProductVersion: 1.0.0.0
FileDescription: two
OriginalFilename: two.exe

MSIL/Injector.QJC also known as:

Elastic	malicious (high confidence)
FireEye	Generic.mg.e5ffca5758d6e11c
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.MSIL.Crypt.4!c
Sangfor	Malware
K7AntiVirus	Trojan ( 00510a5f1 )
K7GW	Trojan ( 00510a5f1 )
CrowdStrike	win/malicious_confidence_80% (D)
BitDefenderTheta	Gen:NN.ZemsilF.34804.um0@aOykeoh
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.QJC
APEX	Malicious
Avast	MSIL:GenMalicious-DRF [Trj]
Kaspersky	Trojan.MSIL.Crypt.dxcm
Tencent	Msil.Trojan.Crypt.Amwd
F-Secure	Trojan.TR/Dropper.MSIL.Gen2
DrWeb	Trojan.KeyLogger.26163
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Sophos	Mal/Generic-S
Ikarus	Trojan-Dropper.Win32.Dapato
Avira	TR/Dropper.MSIL.Gen2
Antiy-AVL	Trojan/MSIL.Crypt
Microsoft	Backdoor:MSIL/Noancooe.C
ZoneAlarm	Trojan.MSIL.Crypt.dxcm
Cynet	Malicious (score: 100)
McAfee	Artemis!E5FFCA5758D6
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/GdSda.A
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	MSIL/Injector.QJC!tr
AVG	MSIL:GenMalicious-DRF [Trj]
Cybereason	malicious.2503a6
Paloalto	generic.ml
Qihoo-360	Win32/Sorter.AVE.DotNetFile.A

How to remove MSIL/Injector.QJC?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

MSIL/Injector.QJC (file analysis)