Categories: Malware

MSIL/Kryptik.TFS (file analysis)

The MSIL/Kryptik.TFS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Kryptik.TFS virus can do?

CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine MSIL/Kryptik.TFS?


File Info:
name: 40916938E20F59D90C82.mlwpath: /opt/CAPEv2/storage/binaries/49a30ccebd6a183b283b80c19ec94f7b58de80d6de658808949060fffdcd36c7crc32: A94078B5md5: 40916938e20f59d90c823595b757b4a0sha1: 25ad656aee514b587d01b5e6b3aafefdc5663f73sha256: 49a30ccebd6a183b283b80c19ec94f7b58de80d6de658808949060fffdcd36c7sha512: aa0f7dbcac8b1bee9eec20d2b474703aff6108e4f3ade6fb4b4f583e40f419b9e91872c84b6945fe28178884fcf944b537ef45d8509c65f4b64c06b59d6a535cssdeep: 98304:9ULxPRCt9HRZzcDehcRZ3/hHeQ4Ft+qY4h8dxr:kgzEg03/hHeQy+d4idxrtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AC26F19215608033B1ABFFA6D95A70F640A4F65810861539CFFC09E90EBB1FC46FF999sha3_384: 65659a0400299987b3e16dc24499e02cc68717d7fcdd68467ab1eade6f1e93a0acf886578c159591eef24849523ac972ep_bytes: ff250020400000000000000000000000timestamp: 2019-10-09 16:53:25
Version Info:
Translation: 0x0000 0x04b0Comments: CompanyName: FileDescription: RainbowCodeGenerationFileVersion: 0.3.0.0InternalName: RainbowCodeGeneration.exeLegalCopyright: Copyright © Heiko Franz 2016-2017LegalTrademarks: OriginalFilename: RainbowCodeGeneration.exeProductName: RainbowCodeGenerationProductVersion: 0.3.0.0Assembly Version: 0.3.0.0

MSIL/Kryptik.TFS also known as:

Bkav	W32.Common.D8C513B6
Lionic	Trojan.Win32.Hesv.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.MSIL.Basic.3.Gen
FireEye	Generic.mg.40916938e20f59d9
Skyhigh	BehavesLike.Win32.Generic.rc
McAfee	GenericRXIZ-EP!40916938E20F
Malwarebytes	Generic.Malware.AI.DDS
Zillya	Trojan.Basic.Win32.118140
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005594c51 )
BitDefender	Trojan.MSIL.Basic.3.Gen
K7GW	Trojan ( 005594c51 )
Cybereason	malicious.aee514
BitDefenderTheta	Gen:NN.ZemsilF.36792.@p0@am5M4Khi
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.TFS
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Nanobot-9774604-0
Kaspersky	HEUR:Trojan.MSIL.Hesv.gen
Alibaba	Trojan:MSIL/Kryptik.c7c0bc43
NANO-Antivirus	Trojan.Win32.Hesv.kbyhfb
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:036+JB9KiLP2Zjc3hDQ82g)
TACHYON	Trojan/W32.DN-Hesv.4753920
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.PWS.Stealer.24943
VIPRE	Trojan.MSIL.Basic.3.Gen
TrendMicro	TROJ_GEN.R03BC0DJ823
Trapmine	suspicious.low.ml.score
Emsisoft	Trojan.MSIL.Basic.3.Gen (B)
Ikarus	Trojan-Spy.HawkEye
GData	Trojan.MSIL.Basic.3.Gen
Jiangmin	Trojan.MSIL.mxzi
Webroot	W32.Trojan.Gen
Varist	W32/Hesv.EZXR-7312
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Win32.Wacatac
Kingsoft	malware.kb.c.1000
Arcabit	Trojan.MSIL.Basic.3.Gen
ZoneAlarm	HEUR:Trojan.MSIL.Hesv.gen
Microsoft	Trojan:MSIL/AgentTesla
Google	Detected
AhnLab-V3	Trojan/Win32.MSIL.C957690
ALYac	Trojan.MSIL.Basic.3.Gen
MAX	malware (ai score=84)
DeepInstinct	MALICIOUS
VBA32	TScope.Trojan.MSIL
Cylance	unsafe
Panda	Trj/PasswordStealer.Y
TrendMicro-HouseCall	TROJ_GEN.R03BC0DJ823
Tencent	Malware.Win32.Gencirc.13f26283
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.73691354.susgen
Fortinet	MSIL/Kryptik.TCC!tr
AVG	Win32:TrojanX-gen [Trj]
Avast	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)