Malware

MSIL/Kryptik.CWO removal tips

Malware Removal

The MSIL/Kryptik.CWO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL/Kryptik.CWO virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • Enumerates the modules from a process (may be used to locate base addresses in process injection)
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics

Related domains:

wpad.local-net

How to determine MSIL/Kryptik.CWO?



File Info:

name: 4A38F44DEECABDB3C1EE.mlw
path: /opt/CAPEv2/storage/binaries/beee32ceb7a245d9da23bd607c98eb0369ac627f9748d165d8b702bcb6ec3996
crc32: 9CD6C019
md5: 4a38f44deecabdb3c1ee72c9aaf26df7
sha1: 1a0bd54fc6f90f8024114dc35e97a237cb82bd31
sha256: beee32ceb7a245d9da23bd607c98eb0369ac627f9748d165d8b702bcb6ec3996
sha512: 2efb3ac3b6df973511f776a12f8c438ce530d84f2b0c26271363e5f69b8acddd1f2583d3564b985bf499d11e6838c1ebe8204fe108b58388e10d24ec19973702
ssdeep: 24576:KtLLsR8kMUIRRw57Fxwg/TGheSJ0KsY39DZ:csmkLI7E78g7Ye60nk9D
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17E359D4C7EC3684EC712C1F346712DECEAAD6C1D4B1E828B595B72A9CD7C45AFA01392
sha3_384: 877b0d5a513fcbae8b7dc5e397427a91d7e6bf5e2ed94211272485f5dd90912f478ca4b1bf702642092a5151882b35a0
ep_bytes: ff250020400000000000000000000000
timestamp: 2015-08-06 16:48:13


Version Info:

Translation: 0x0000 0x04b0
Comments: eRXXRdnz
FileDescription: eRXXRdnz
FileVersion: 1.1.4.3
InternalName: eRXXRdnz.exe
LegalCopyright: Copyright eRXXRdnz ©  2015
OriginalFilename: eRXXRdnz.exe
ProductName: eRXXRdnz
ProductVersion: 1.1.4.3
Assembly Version: 1.1.4.3

MSIL/Kryptik.CWO also known as:

LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
DrWebTrojan.Siggen6.28287
CynetMalicious (score: 99)
FireEyeGeneric.mg.4a38f44deecabdb3
McAfeeDropper-FOQ!4A38F44DEECA
K7AntiVirusTrojan ( 0055e3981 )
AlibabaTrojan:MSIL/Kryptik.bb6d048b
K7GWTrojan ( 0055e3981 )
CrowdStrikewin/malicious_confidence_90% (W)
BitDefenderThetaGen:NN.ZemsilF.34294.fn0@aKyDyzn
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Kryptik.CWO
TrendMicro-HouseCallTROJ_GEN.R002C0PKL21
Paloaltogeneric.ml
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Zusy.158907
MicroWorld-eScanGen:Variant.Zusy.158907
AvastWin32:Malware-gen
TencentWin32.Trojan.Generic.Pcsu
Ad-AwareGen:Variant.Zusy.158907
SophosML/PE-A + Troj/MSIL-ENC
F-SecureHeuristic.HEUR/AGEN.1104061
TrendMicroTROJ_GEN.R002C0PKL21
EmsisoftGen:Variant.Zusy.158907 (B)
IkarusTrojan.MSIL.Crypt
GDataGen:Variant.Zusy.158907
eGambitUnsafe.AI_Score_98%
AviraHEUR/AGEN.1104061
MAXmalware (ai score=83)
Antiy-AVLTrojan/Generic.ASMalwS.13D378C
GridinsoftRansom.Win32.Wacatac.sa
MicrosoftTrojan:Win32/Wacatac.B!ml
AhnLab-V3Trojan/Win.Nitol.C4775861
VBA32Trojan.MSIL.Inject
APEXMalicious
YandexTrojan.Agent!mNIPGX88Dvg
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/Kryptik.CWO!tr
WebrootW32.Trojan.Gen
AVGWin32:Malware-gen
Cybereasonmalicious.deecab
PandaTrj/CI.A

How to remove MSIL/Kryptik.CWO?

MSIL/Kryptik.CWO removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment