MSIL/Kryptik.AAYD malicious file

The MSIL/Kryptik.AAYD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Kryptik.AAYD virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Creates a hidden or system file
Creates a copy of itself

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine MSIL/Kryptik.AAYD?


File Info:
crc32: FE4AF971
md5: f6ccf43444b249adb50a6c030fc2cf19
name: F6CCF43444B249ADB50A6C030FC2CF19.mlw
sha1: 7d928e0e82d113bf48778077d75ecbc451bbb538
sha256: 4a4c375877077ce8bdc0de664fda9b28a53144330076da325786aef10523762b
sha512: dad748019683dd1f4fabd3e6c7bdb75c4b1f0ba2a8d2a8cc9d4d4ef01414c419399becd09d56e2fa79a7235c4249337254e795d9f11aa7a4a8fe65a8e15292d6
ssdeep: 12288:FktE/V4+xOqjhZI9zJUPw+RExQaoV48eMixF+MGOtFLzjzE:Cm/V4BqjhZI96PkxNGdVm1HLv
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2017 - 2021
Assembly Version: 1.0.0.0
InternalName: IValueTupleInternal.exe
FileVersion: 1.0.0.0
CompanyName: Microsoft
LegalTrademarks: 
Comments: 
ProductName: Agent Common
ProductVersion: 1.0.0.0
FileDescription: Agent Common
OriginalFilename: IValueTupleInternal.exe

MSIL/Kryptik.AAYD also known as:

K7AntiVirus	Riskware ( 0040eff71 )
Elastic	malicious (high confidence)
DrWeb	Trojan.PackedNET.742
McAfee	GenericRXMB-KC!F6CCF43444B2
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	TrojanSpy:MSIL/Kryptik.99cc9fc4
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.e82d11
Cyren	W32/MSIL_Kryptik.EHI.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Kryptik.AAYD
Zoner	Trojan.Win32.110929
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender	Trojan.GenericKD.46306976
MicroWorld-eScan	Trojan.GenericKD.46306976
Ad-Aware	Trojan.GenericKD.46306976
Sophos	ML/PE-A + Troj/MSIL-RCQ
BitDefenderTheta	Gen:NN.ZemsilF.34690.Pm0@airZXxn
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jc
FireEye	Generic.mg.f6ccf43444b249ad
Emsisoft	Trojan.GenericKD.46306976 (B)
SentinelOne	Static AI – Malicious PE
Webroot	W32.Trojan.MSIL.Taskun
Avira	TR/AD.AgentTesla.cgbbn
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Woreflint.A!cl
GData	Trojan.GenericKD.46306976
AhnLab-V3	Trojan/Win.KC.C4475933
MAX	malware (ai score=86)
Malwarebytes	Malware.AI.2052347513
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.F0D1C00EG21
Rising	Trojan.Woreflint!8.F5EA (CLOUD)
Ikarus	Trojan.Inject
Fortinet	MSIL/Kryptik.AAXQ!tr
AVG	Win32:RATX-gen [Trj]
Paloalto	generic.ml

How to remove MSIL/Kryptik.AAYD?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

MSIL/Kryptik.AAYD malicious file