Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Malware
Threat report

How to remove “MSIL/Kryptik.AEKB”?

Published May 1, 2024 Malware category 3 min read
Report context

What to verify before removal

This report keeps How to remove “MSIL/Kryptik.AEKB”? in the active library because the detection has enough technical context to support a careful second-opinion scan and cleanup decision.

Start by comparing the local file name with 1CAF0DBDF9B3918D7419.mlw, then review the behavior notes for persistence entries, dropped files, unusual processes, and browser or network changes. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
1CAF0DBDF9B3918D7419.mlw
  • Compare the suspicious file name with 1CAF0DBDF9B3918D7419.mlw.
  • Confirm the detection name matches How to remove “MSIL/Kryptik.AEKB”? before removing related files.
  • Review the report for persistence entries, dropped files, unusual processes, and browser or network changes so the cleanup is based on observed behavior, not only the label.
  • Run a full scan, quarantine confirmed detections, and restart before signing back in to sensitive accounts.

The MSIL/Kryptik.AEKB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What MSIL/Kryptik.AEKB virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary compilation timestomping detected

How to determine MSIL/Kryptik.AEKB?



File Info:

name: 1CAF0DBDF9B3918D7419.mlw
path: /opt/CAPEv2/storage/binaries/89f2a1507c5531c91fa72e23b2e831ff8cae8626d1f86b81d6fa0caeb883101f
crc32: 4FAC4039
md5: 1caf0dbdf9b3918d7419163d5c3def14
sha1: e3578731004ab04da8f05854d7925235dbfc8e08
sha256: 89f2a1507c5531c91fa72e23b2e831ff8cae8626d1f86b81d6fa0caeb883101f
sha512: 91969d88010147dbdcf6ae61fbd4e95ed9ab2d4f1f3ea2931a7fc658b3d0182d9a3e39917c23e19476a14a6912a8b0feae2bc0fcd31b056b776a07a68dd28d35
ssdeep: 49152:u0k0USoDSRYarJ0Tr6y5Zgwu6SRon7ao0k0USoDSRYarJ0Tr6y5Zgwu6SRon7a:ft0UhsOAulGn7aht0UhsOAulGn7a
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18AE5DF142BEA4F38E8368BB1CAD0EFA1977DA221D54860B554000E1B4655BFC8DDEEFD
sha3_384: 22b5fa475cff79016d143fd2ea59753397271f96b99f077140c5f6851ed2eab8ce88e289c012867b3cccfb53f1f45607
ep_bytes: ff250020400000000000000000000000
timestamp: 2098-11-23 03:30:03


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: Microsoft
FileDescription: Resource Monitor
FileVersion: 1.0.0.0
InternalName: TypeInitializationExcept.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: TypeInitializationExcept.exe
ProductName: Resource Monitor
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Kryptik.AEKB also known as:

Bkav W32.AIDetectMalware.CS
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Ransom.Loki.GDM
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
Skyhigh AgentTesla-FDFR!1CAF0DBDF9B3
McAfee AgentTesla-FDFR!1CAF0DBDF9B3
Malwarebytes Spyware.PasswordStealer
VIPRE Trojan.Ransom.Loki.GDM
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0058ef621 )
K7GW Trojan ( 0058ef621 )
VirIT Trojan.Win32.MSIL_Heur.A
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of MSIL/Kryptik.AEKB
ClamAV Win.Dropper.LokiBot-10023563-0
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender Trojan.Ransom.Loki.GDM
NANO-Antivirus Trojan.Win32.Agensla.jrxilg
Avast Win32:PWSX-gen [Trj]
Tencent Malware.Win32.Gencirc.13b6da07
Emsisoft Trojan.Agent (A)
F-Secure Heuristic.HEUR/AGEN.1365522
DrWeb BackDoor.SpyBotNET.25
Zillya Trojan.Kryptik.Win32.3789583
FireEye Generic.mg.1caf0dbdf9b3918d
Sophos Troj/MSIL-SLC
Ikarus Trojan-Spy.AgentTesla
Jiangmin Trojan.PSW.MSIL.dtlh
Google Detected
Avira HEUR/AGEN.1365522
Varist W32/MSIL_Troj.BYP.gen!Eldorado
Antiy-AVL Trojan[PSW]/MSIL.Agensla
Microsoft Trojan:MSIL/AgentTesla.EKI!MTB
Arcabit Trojan.Ransom.Loki.GDM
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData MSIL.Trojan.BSE.112A9AZ
AhnLab-V3 Trojan/Win.FDFR.C4991753
ALYac Trojan.Ransom.Loki.GDM
MAX malware (ai score=88)
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:1eAIMUroFHuVVk9XumlNrA)
Yandex Trojan.Kryptik!8eOK7uxTOhw
SentinelOne Static AI – Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/GenericKDS.61009645!tr
BitDefenderTheta Gen:NN.ZemsilF.36804.gp0@auLjy3l
AVG Win32:PWSX-gen [Trj]
DeepInstinct MALICIOUS

How to remove MSIL/Kryptik.AEKB?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.