MSIL/Kryptik.NJJ malicious file

The MSIL/Kryptik.NJJ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Kryptik.NJJ virus can do?

Executable code extraction
Creates RWX memory
A process attempted to delay the analysis task.
At least one IP Address, Domain, or File Name was found in a crypto call
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Looks up the external IP address
Exhibits behavior characteristic of iSpy Keylogger
Checks the version of Bios, possibly for anti-virtualization
Checks the CPU name from registry, possibly for anti-virtualization
Collects information to fingerprint the system

Related domains:

z.whorecord.xyz

a.tomx.xyz

bot.whatismyipaddress.com

How to determine MSIL/Kryptik.NJJ?


File Info:
crc32: B508BB91
md5: dbb8b6cd288dc94eac9704e7b2a32b37
name: DBB8B6CD288DC94EAC9704E7B2A32B37.mlw
sha1: cde7886094aea4eed97f1fc62c4be494447c5d6d
sha256: de54f91164a8f07fa88be3e4472b9dc440ac75edcabc4be84f8acf66e0bcd13a
sha512: bd70d9a3cd25d2865351c4aa1c742850c21ee69ba61c326ed09710f89ff4d226d3d5ba3506a48fd46a2cb952aadfd4ce20be97a96507092a7c1b07c8edba71e9
ssdeep: 12288:91w+LI9mZtbn/ShXxHPio/VWyKi/Fv2+AUNSxuMsFdQ8+1N2/NhXkgEt8+0zngh:vztjMTKidv2INVFO8+1NsbzPzn
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 2018 Qatar Petroleum
Assembly Version: 0.0.0.0
InternalName: Order6646.exe
FileVersion: 4.2.7.1
CompanyName: Qatar Petroleum
Comments: y1mufeepsa3
ProductName: Backup, recovery and DR in one appliance-based solution thatx2019s easy-to-use and scalable.
ProductVersion: 4.2.7.1
FileDescription: Backup, recovery and DR in one appliance-based solution thatx2019s easy-to-use and scalable.
OriginalFilename: Order6646.exe

MSIL/Kryptik.NJJ also known as:

K7AntiVirus	Trojan ( 0052b3781 )
Elastic	malicious (high confidence)
DrWeb	Tool.PassView.1835
Cynet	Malicious (score: 100)
ALYac	Gen:Heur.MSIL.Pretoria.1
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 0052b3781 )
Cybereason	malicious.d288dc
Symantec	Packed.Generic.522
ESET-NOD32	a variant of MSIL/Kryptik.NJJ
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan.Win32.Llac.lllc
BitDefender	Gen:Heur.MSIL.Pretoria.1
NANO-Antivirus	Trojan.Win32.Llac.ezfujm
MicroWorld-eScan	Gen:Heur.MSIL.Pretoria.1
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Gen:Heur.MSIL.Pretoria.1
Sophos	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZemsilF.34170.4m0@aa3!QR
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
FireEye	Generic.mg.dbb8b6cd288dc94e
Emsisoft	Gen:Heur.MSIL.Pretoria.1 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1122309
Antiy-AVL	Trojan/Generic.ASMalwS.2521452
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Heur.MSIL.Pretoria.1
McAfee	Packed-FEU!DBB8B6CD288D
MAX	malware (ai score=98)
VBA32	Trojan.Llac
Malwarebytes	Ransom.Crysis
Panda	Trj/GdSda.A
Ikarus	Trojan-Spy.MSIL.Siplog
Fortinet	MSIL/Kryptik.NJJ!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove MSIL/Kryptik.NJJ?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

MSIL/Kryptik.NJJ malicious file