Malware

MSIL/Kryptik.TFS (file analysis)

Malware Removal

The MSIL/Kryptik.TFS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL/Kryptik.TFS virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine MSIL/Kryptik.TFS?



File Info:

name: 40916938E20F59D90C82.mlw
path: /opt/CAPEv2/storage/binaries/49a30ccebd6a183b283b80c19ec94f7b58de80d6de658808949060fffdcd36c7
crc32: A94078B5
md5: 40916938e20f59d90c823595b757b4a0
sha1: 25ad656aee514b587d01b5e6b3aafefdc5663f73
sha256: 49a30ccebd6a183b283b80c19ec94f7b58de80d6de658808949060fffdcd36c7
sha512: aa0f7dbcac8b1bee9eec20d2b474703aff6108e4f3ade6fb4b4f583e40f419b9e91872c84b6945fe28178884fcf944b537ef45d8509c65f4b64c06b59d6a535c
ssdeep: 98304:9ULxPRCt9HRZzcDehcRZ3/hHeQ4Ft+qY4h8dxr:kgzEg03/hHeQy+d4idxr
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AC26F19215608033B1ABFFA6D95A70F640A4F65810861539CFFC09E90EBB1FC46FF999
sha3_384: 65659a0400299987b3e16dc24499e02cc68717d7fcdd68467ab1eade6f1e93a0acf886578c159591eef24849523ac972
ep_bytes: ff250020400000000000000000000000
timestamp: 2019-10-09 16:53:25


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: RainbowCodeGeneration
FileVersion: 0.3.0.0
InternalName: RainbowCodeGeneration.exe
LegalCopyright: Copyright © Heiko Franz 2016-2017
LegalTrademarks: 
OriginalFilename: RainbowCodeGeneration.exe
ProductName: RainbowCodeGeneration
ProductVersion: 0.3.0.0
Assembly Version: 0.3.0.0

MSIL/Kryptik.TFS also known as:

BkavW32.Common.D8C513B6
LionicTrojan.Win32.Hesv.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.MSIL.Basic.3.Gen
FireEyeGeneric.mg.40916938e20f59d9
SkyhighBehavesLike.Win32.Generic.rc
McAfeeGenericRXIZ-EP!40916938E20F
MalwarebytesGeneric.Malware.AI.DDS
ZillyaTrojan.Basic.Win32.118140
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005594c51 )
BitDefenderTrojan.MSIL.Basic.3.Gen
K7GWTrojan ( 005594c51 )
Cybereasonmalicious.aee514
BitDefenderThetaGen:NN.ZemsilF.36792.@p0@am5M4Khi
VirITTrojan.Win32.MSIL_Heur.A
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Kryptik.TFS
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Trojan.Nanobot-9774604-0
KasperskyHEUR:Trojan.MSIL.Hesv.gen
AlibabaTrojan:MSIL/Kryptik.c7c0bc43
NANO-AntivirusTrojan.Win32.Hesv.kbyhfb
RisingMalware.Obfus/MSIL@AI.100 (RDM.MSIL2:036+JB9KiLP2Zjc3hDQ82g)
TACHYONTrojan/W32.DN-Hesv.4753920
SophosMal/Generic-S
F-SecureTrojan.TR/Dropper.Gen
DrWebTrojan.PWS.Stealer.24943
VIPRETrojan.MSIL.Basic.3.Gen
TrendMicroTROJ_GEN.R03BC0DJ823
Trapminesuspicious.low.ml.score
EmsisoftTrojan.MSIL.Basic.3.Gen (B)
IkarusTrojan-Spy.HawkEye
GDataTrojan.MSIL.Basic.3.Gen
JiangminTrojan.MSIL.mxzi
WebrootW32.Trojan.Gen
VaristW32/Hesv.EZXR-7312
AviraTR/Dropper.Gen
Antiy-AVLTrojan/Win32.Wacatac
Kingsoftmalware.kb.c.1000
ArcabitTrojan.MSIL.Basic.3.Gen
ZoneAlarmHEUR:Trojan.MSIL.Hesv.gen
MicrosoftTrojan:MSIL/AgentTesla
GoogleDetected
AhnLab-V3Trojan/Win32.MSIL.C957690
ALYacTrojan.MSIL.Basic.3.Gen
MAXmalware (ai score=84)
DeepInstinctMALICIOUS
VBA32TScope.Trojan.MSIL
Cylanceunsafe
PandaTrj/PasswordStealer.Y
TrendMicro-HouseCallTROJ_GEN.R03BC0DJ823
TencentMalware.Win32.Gencirc.13f26283
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.73691354.susgen
FortinetMSIL/Kryptik.TCC!tr
AVGWin32:TrojanX-gen [Trj]
AvastWin32:TrojanX-gen [Trj]
CrowdStrikewin/malicious_confidence_100% (W)

How to remove MSIL/Kryptik.TFS?

MSIL/Kryptik.TFS removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment