MSIL/Kryptik.KXZ removal guide

The MSIL/Kryptik.KXZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Kryptik.KXZ virus can do?

.NET file is packed/obfuscated with Confuser
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/Kryptik.KXZ?


File Info:
name: 7DE893E935D68A1AEF82.mlw
path: /opt/CAPEv2/storage/binaries/00d100854eeca839bb80579bd5d56b415d2f77381c9d566ba8271ec3905fd0c3
crc32: 3E45D970
md5: 7de893e935d68a1aef825cc646321104
sha1: 69db2bde79e83a813508ec20c3300780eca6293e
sha256: 00d100854eeca839bb80579bd5d56b415d2f77381c9d566ba8271ec3905fd0c3
sha512: 142f4e75d524efb3fa582805b5b2c6d4b86f00750e2288a01eb81f50e5a00fbb0ee41029f98f536a61bc4f30973fb5fac80729ee5866d42d680ba8a776851f67
ssdeep: 6144:aCZsTU4DZjUJ4XGkfMlN++hWvAZGbgjljren3NzDQuUgk/mUXwyDF/lPXG5P3Ms2:aCHwUGPfM861sUvl+ktDw6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T109A44B1153737585CB20D8B19096D2FD01609FE67E535BE2A0BCFB2906BC25ACD0BBDA
sha3_384: 04a9efebeeddf0347dc231014759b4e5f0ebc85b57190a181a31db248a9f0158ed0f9911c258c633f47c235765285864
ep_bytes: ff250020400000000000000000000000
timestamp: 2015-06-21 22:38:20

Version Info:
Translation: 0x0000 0x04b0
Comments: RPX 1.3.4400.61



FileDescription:  
FileVersion: 0.0.0.0
InternalName: Server.exe
LegalCopyright:  
OriginalFilename: Server.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

MSIL/Kryptik.KXZ also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Reconyc.4!c
MicroWorld-eScan	Gen:Heur.MSIL.Bladabindi.1
ClamAV	Win.Packed.Hpbladabi-6860330-0
FireEye	Generic.mg.7de893e935d68a1a
McAfee	BackDoor-FAXR!7DE893E935D6
Cylance	Unsafe
Zillya	Trojan.Reconyc.Win32.11305
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 00528cb81 )
K7GW	Trojan ( 00528cb81 )
Cybereason	malicious.935d68
BitDefenderTheta	Gen:NN.ZemsilF.34592.Cm0@aytT8de
Cyren	W32/MSIL_Confuser.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.KXZ
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Reconyc.elrl
BitDefender	Gen:Heur.MSIL.Bladabindi.1
NANO-Antivirus	Trojan.Win32.Reconyc.dthhjc
Avast	Win32:Malware-gen
Tencent	Win32.Trojan.Reconyc.Amwm
Ad-Aware	Gen:Heur.MSIL.Bladabindi.1
Emsisoft	Gen:Heur.MSIL.Bladabindi.1 (B)
DrWeb	Trojan.DownLoader10.45391
VIPRE	Gen:Heur.MSIL.Bladabindi.1
TrendMicro	TSPY_HPCUBESTLR.SM
McAfee-GW-Edition	BackDoor-FAXR!7DE893E935D6
Trapmine	malicious.high.ml.score
Sophos	Mal/MSIL-PX
Ikarus	Trojan.MSIL.Inject
GData	Gen:Heur.MSIL.Bladabindi.1
Jiangmin	Trojan.Reconyc.azo
Avira	HEUR/AGEN.1227310
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Generic.ASBOL.38BB
Microsoft	Backdoor:MSIL/Bladabindi
Google	Detected
AhnLab-V3	Trojan/Win32.Agent.R150506
Malwarebytes	Trojan.Agent.RP
TrendMicro-HouseCall	TSPY_HPCUBESTLR.SM
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:uBc0Fzk40xAAeH3iBTOmCw)
Yandex	Trojan.Reconyc!MpsYOjJzJS0
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Injecto.58E1!tr
AVG	Win32:Malware-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (D)

How to remove MSIL/Kryptik.KXZ?

MSIL/Kryptik.KXZ removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X