Malware

MSIL/Kryptik.OU removal guide

Malware Removal

The MSIL/Kryptik.OU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL/Kryptik.OU virus can do?

  • Uses Windows utilities for basic functionality
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Binary file triggered YARA rule
  • Creates a copy of itself
  • Creates known Njrat/Bladabindi RAT registry keys
  • Yara detections observed in process dumps, payloads or dropped files

How to determine MSIL/Kryptik.OU?



File Info:

name: A1C48B71D3D242AA7463.mlw
path: /opt/CAPEv2/storage/binaries/325b7e12a806ba7b8a0c19728ae39b6223e39aa4734c88092b3a475bb2cacd8c
crc32: CCB5DE4B
md5: a1c48b71d3d242aa7463667d798d5066
sha1: ef8c07170f41743177124733c48e8337fc9d23c5
sha256: 325b7e12a806ba7b8a0c19728ae39b6223e39aa4734c88092b3a475bb2cacd8c
sha512: 996b0ee482bfc6b69d04ae766b7f7f65c1113f035e5bad99f397fbf29d5824ab4b09db649a0993be72483841e9aca45c756d8c8812c0914c145c4b6b65aacfec
ssdeep: 1536:NingXu5iAUkwwRJ/n0LJA/OQWMeyiGlI2j9d:N5XuHJ/0La/OqnK2j9d
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18F63F11F736C0037E9794670E93AD3A024AEDB60B927023AA5416336E46B857E33593B
sha3_384: fee892ffdd4d25dcd9dbe0aa211ec0bd542c679aa946fb2e4a71b86331d4838e15de3eb4435d2e943ea5ec2c12bbac05
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-09-23 18:08:29


Version Info:

Translation: 0x0000 0x04b0
Comments: h?lSl&&)29
CompanyName: g8jLj446TZ
FileDescription: g8jLj446TZ
FileVersion: 4.1.5.​0
InternalName: pppppppp1212.exe
LegalCopyright: g8jLj446TZ
LegalTrademarks: h?lSl&&)29
OriginalFilename: pppppppp1212.exe
ProductName: h?lSl&&)29
ProductVersion: 4.1.5.​0
Assembly Version: 4.2.4.5

MSIL/Kryptik.OU also known as:

BkavW32.AIDetectMalware.CS
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Siggen.27548
MicroWorld-eScanGen:Heur.MSIL.Androm.3
FireEyeGeneric.mg.a1c48b71d3d242aa
SkyhighTrojan-FDWX!A1C48B71D3D2
McAfeeTrojan-FDWX!A1C48B71D3D2
Cylanceunsafe
ZillyaTrojan.Kryptik.Win32.3918121
SangforSuspicious.Win32.Save.a
AlibabaTrojan:MSIL/Kryptik.3650ab22
K7GWTrojan ( 700000121 )
K7AntiVirusTrojan ( 700000121 )
BitDefenderThetaGen:NN.ZemsilF.36802.em0@aaIcnIb
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Kryptik.OU
APEXMalicious
TrendMicro-HouseCallTROJ_GEN.R002C0PDI24
ClamAVWin.Dropper.Gamarue-6996681-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Heur.MSIL.Androm.3
AvastMSIL:Agent-BBO [Trj]
TencentWin32.Trojan.Generic.Adhl
EmsisoftGen:Heur.MSIL.Androm.3 (B)
F-SecureTrojan.TR/Keylogger.AY
VIPREGen:Heur.MSIL.Androm.3
TrendMicroTROJ_GEN.R002C0PDI24
Trapminesuspicious.low.ml.score
SophosMal/Generic-S
SentinelOneStatic AI – Malicious PE
MAXmalware (ai score=81)
GoogleDetected
AviraTR/Keylogger.AY
VaristW32/MSIL_Troj.DB.gen!Eldorado
Antiy-AVLTrojan/MSIL.Kryptik
MicrosoftTrojan:Win32/Wacatac.B!ml
XcitiumTrojWare.MSIL.Kryptik.AD@56p4w1
ArcabitTrojan.MSIL.Androm.3
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataGen:Heur.MSIL.Androm.3
VBA32Trojan.MSIL.gen.c.1
MalwarebytesMachineLearning/Anomalous.100%
PandaTrj/CI.A
RisingTrojan.DynCode!1.9F2C (CLASSIC)
IkarusTrojan.MSIL.Crypt
MaxSecureTrojan.Malware.7164915.susgen
FortinetMSIL/Dropper.PM!tr
AVGMSIL:Agent-BBO [Trj]
DeepInstinctMALICIOUS
alibabacloudMalware:MSIL/NanoBot.A

How to remove MSIL/Kryptik.OU?

MSIL/Kryptik.OU removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment