About "MSIL/Kryptik.LGQ" infection

The MSIL/Kryptik.LGQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Kryptik.LGQ virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Reads data out of its own binary image
A process created a hidden window
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Sniffs keystrokes
A process attempted to delay the analysis task by a long amount of time.
Installs itself for autorun at Windows startup

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine MSIL/Kryptik.LGQ?


File Info:
crc32: D1F1ED29
md5: 3a8cc23e0326a476d3ff50a3be7393b5
name: 3A8CC23E0326A476D3FF50A3BE7393B5.mlw
sha1: 46d5727f6ec7a9d68a6400b8af96c7512679cca8
sha256: 23bfb4720da4f3cd6fb46abd7e353acb54c3be4fca7d1dc7db8ed236af21cf71
sha512: d93e10a1965c24d4a0486b0358ad17520aa5ccdb9857b6729e5fabd1e5f9c535b1dbb76ef178cf033b72548fc7c842702889624363f031daffe37ea28ea249e7
ssdeep: 24576:MjdyeHSP8JsEMr8XJwf4FBEQDQhKktoV:Idyn4M8Xif47EQD
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright:  
Assembly Version: 0.0.0.0
InternalName: RegGen.exe
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
FileDescription:  
OriginalFilename: RegGen.exe

MSIL/Kryptik.LGQ also known as:

K7AntiVirus	Trojan ( 0051981f1 )
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Trojan.MSIL.Basic.3.Gen
Cylance	Unsafe
Zillya	Dropper.Generic.Win32.2975
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	TrojanDropper:Win32/Kryptik.10fab1aa
K7GW	Trojan ( 0051981f1 )
Cybereason	malicious.e0326a
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.LGQ
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan-Dropper.Win32.Generic
BitDefender	Trojan.MSIL.Basic.3.Gen
NANO-Antivirus	Trojan.Win32.Kryptik.fjiqez
MicroWorld-eScan	Trojan.MSIL.Basic.3.Gen
Tencent	Win32.Trojan-dropper.Generic.Llro
Ad-Aware	Trojan.MSIL.Basic.3.Gen
Sophos	Mal/Generic-S
Comodo	TrojWare.MSIL.Golroted.EJU@7duncy
BitDefenderTheta	Gen:NN.ZemsilF.34294.bn0@ae!eCKn
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	BKDR_NOANCOOE.SMF
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
FireEye	Generic.mg.3a8cc23e0326a476
Emsisoft	Trojan.MSIL.Basic.3.Gen (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanDropper.Generic.caw
Avira	HEUR/AGEN.1122372
eGambit	Unsafe.AI_Score_100%
Antiy-AVL	Trojan/Generic.ASMalwS.28A9D08
Microsoft	Backdoor:MSIL/Bladabindi
GData	Trojan.MSIL.Basic.3.Gen
AhnLab-V3	Win-Trojan/MSILKrypt03.Exp
McAfee	Packed-TG!3A8CC23E0326
MAX	malware (ai score=100)
VBA32	Backdoor.MSIL.Bladabindi
Malwarebytes	MachineLearning/Anomalous.97%
Panda	Trj/GdSda.A
TrendMicro-HouseCall	BKDR_NOANCOOE.SMF
Yandex	Trojan.Kryptik!LyTQLf0SJ3Q
Ikarus	Trojan.MSIL.Inject
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Kryptik.LGQ!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml

How to remove MSIL/Kryptik.LGQ?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “MSIL/Kryptik.LGQ” infection