Should I remove “MSIL/Kryptik.AGGV”?

The MSIL/Kryptik.AGGV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Kryptik.AGGV virus can do?

Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/Kryptik.AGGV?


File Info:
name: C0A0D55BF006691F1C44.mlw
path: /opt/CAPEv2/storage/binaries/1f44242a8aea1a41fedf83edc5273d6013c31615d92caa9661c53b577cd1175b
crc32: FB5D0128
md5: c0a0d55bf006691f1c44e5c7dd1e3672
sha1: cc9fa565965a29014956d1821a4c066ae39b85bf
sha256: 1f44242a8aea1a41fedf83edc5273d6013c31615d92caa9661c53b577cd1175b
sha512: 9798c1ed32f3066028e4a4c1c0b3f2138bd5f1ab877947eceb76fe29941961608b9e0b702afea33915877f2491bc96c8e3d5bd0d308216d8510d4c9ebaef78e6
ssdeep: 49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T153366CFEA779F2D9D94323EA1740F182288CD8D401B5B526EF5BB5D29308741CBB52A3
sha3_384: 662cd327366ed9c74031c9e28341088216a5c9ecb32c5938f2c5907795eb19059673ee918a95039c3bde2a1d47b342bc
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-09-29 19:30:12

Version Info:
Translation: 0x0000 0x0514
ProductName: hzmpQdD3dFQk15Ju014AIQuR
CompanyName: dORgD8fIbcRNbBf32p0ZzdVLgCpr
InternalName: gYNofg.exe
LegalCopyright: vPoGfpEJ1TD0
Comments: HPjh2M93F
OriginalFilename: BYK7JWDgJWPGfAzcJoLTV9lMDYloh.exe
ProductVersion: 888.436.378.180
FileVersion: 489.271.328.186

MSIL/Kryptik.AGGV also known as:

DrWeb	Trojan.PackedNET.1579
MicroWorld-eScan	Gen:Trojan.Mardom.ON.24
ALYac	Gen:Trojan.Mardom.ON.24
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.5965a2
BitDefenderTheta	Gen:NN.ZemsilF.34754.@p0@amm@3Pi
Cyren	W32/MSIL_Kryptik.IEJ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AGGV
APEX	Malicious
Kaspersky	HEUR:Backdoor.MSIL.Zlugin.gen
BitDefender	Gen:Trojan.Mardom.ON.24
Avast	Win32:CrypterX-gen [Trj]
Ad-Aware	Gen:Trojan.Mardom.ON.24
Emsisoft	Gen:Trojan.Mardom.ON.24 (B)
VIPRE	Gen:Trojan.Mardom.ON.24
McAfee-GW-Edition	BehavesLike.Win32.Dropper.rz
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.c0a0d55bf006691f
SentinelOne	Static AI – Malicious PE
GData	Gen:Trojan.Mardom.ON.24
Jiangmin	Backdoor.MSIL.fzeu
Google	Detected
Avira	HEUR/AGEN.1231989
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Generic.ASMalwS.3E3F
Arcabit	Trojan.Mardom.ON.24
Microsoft	Backdoor:Win32/Bladabindi!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C5266637
Acronis	suspicious
McAfee	GenericRXUK-CE!C0A0D55BF006
TACHYON	Backdoor/W32.DN-Zlugin.5167616
VBA32	TScope.Trojan.MSIL
Malwarebytes	Malware.AI.4275796029
Rising	Backdoor.Zlugin!8.12C86 (TFE:dGZlOgw+tcr/ORRtHQ)
Ikarus	Trojan.MSIL.Crypt
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Kryptik.AGGV!tr
AVG	Win32:CrypterX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove MSIL/Kryptik.AGGV?

MSIL/Kryptik.AGGV removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X