MSIL/Kryptik.RSL removal instruction

The MSIL/Kryptik.RSL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Kryptik.RSL virus can do?

CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine MSIL/Kryptik.RSL?


File Info:
name: DA0858FB781428A2ACEE.mlw
path: /opt/CAPEv2/storage/binaries/f473356281a196cda2665d3b0aa4afc8539978c60e4a5182a639bca0b541fd13
crc32: 24F57BD0
md5: da0858fb781428a2acee1066fda0bc79
sha1: 5383222e78127045a704bd3e5717bd5be9948bc9
sha256: f473356281a196cda2665d3b0aa4afc8539978c60e4a5182a639bca0b541fd13
sha512: efba284d5d32afafa7bdac4c83ef26a35cf1a07c4b2a6ec6d59d8686f57c3a40d1c4bc77d44bd67cf1ed6e25e95532342de270cba61e416fb44c1867d694b92f
ssdeep: 12288:FBO/U+oVQkAuBpRPHPL1/MJrImqliFDyujsTRtZfve77qMfu:q/UN1bNHpEImWikpG7fu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C8B563FA16856FA4C82FE33444E510179BEA8CE69359D7CF6A30537B879F6B8C98040D
sha3_384: 9f36de0227602e77f140875fe28bbe5504454ffb1db09bed03f19963d221ed2fe4a1a2b308993b29be7acd1388c49857
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-09-29 07:35:28

Version Info:
Translation: 0x0000 0x04b0
FileDescription: WindowsApplication1
FileVersion: 1.0.0.0
InternalName: WindowsApplication1.exe
LegalCopyright: Copyright ©  2022
OriginalFilename: WindowsApplication1.exe
ProductName: WindowsApplication1
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Kryptik.RSL also known as:

Bkav	W32.AIDetectNet.01
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.e78127
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.RSL
APEX	Malicious
Cynet	Malicious (score: 100)
FireEye	Generic.mg.da0858fb781428a2
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Avira	TR/Dropper.MSIL.Gen
Acronis	suspicious
Malwarebytes	Backdoor.Bladabindi.MSIL
MaxSecure	Trojan.Malware.300983.susgen
CrowdStrike	win/malicious_confidence_70% (D)

How to remove MSIL/Kryptik.RSL?

MSIL/Kryptik.RSL removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X