Malware

MSIL/Kryptik.UMD information

Malware Removal

The MSIL/Kryptik.UMD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL/Kryptik.UMD virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • A process attempted to delay the analysis task.
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous .NET characteristics
  • Collects and encrypts information about the computer likely to send to C2 server
  • Installs itself for autorun at Windows startup

How to determine MSIL/Kryptik.UMD?



File Info:

name: 0DFBA212A98F5A815A9B.mlw
path: /opt/CAPEv2/storage/binaries/314c626fad412b0cab05861528c009b990e53fafbe60e097e8fbbe98d04463c3
crc32: 3F636CA9
md5: 0dfba212a98f5a815a9b18122b9634fa
sha1: 89fbe07bf39a31fa8cb8e116c78344b571135114
sha256: 314c626fad412b0cab05861528c009b990e53fafbe60e097e8fbbe98d04463c3
sha512: 4a3d005b7e92cf143e28a9d7d0ee95547ae6dfc88fc62239f971c3c01c98897ad18cf920413ca5e6489b5dbee766af7d60bb68dc94156711df6da0f9f3082297
ssdeep: 6144:PyWyBq5iK0vQJHkGFG+4XPd8ek+yJb+8Byz+IZKSLPFpQMqXt/gfYtoa/b11111w:xyBkiKPJE6ud8dHJb+/5lLtmgfYV/L
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FDD47DC9BF75C652D5280ABF60552F811F30A8F3E012FFE676986889A9413ED2E1D50F
sha3_384: fe814dd226d6b2606769314cb5bad479349c91b15ed498da9d5342ee5eae5516b040c3dfa7c28868fbe7bd292b675aaf
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-12-06 13:14:20


Version Info:

Translation: 0x040c 0x04e4
FileDescription: ToYcon
FileVersion: 0.8.0.0
InternalName: ToYcon
LegalCopyright: © Lefreut 2006-2009
OriginalFilename: 00.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0
Author: Lefreut

MSIL/Kryptik.UMD also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.38215413
FireEyeGeneric.mg.0dfba212a98f5a81
ALYacTrojan.GenericKD.38215413
CylanceUnsafe
K7AntiVirusTrojan ( 0055f7dd1 )
AlibabaTrojan:MSIL/Kryptik.d799feb1
K7GWTrojan ( 0055f7dd1 )
CrowdStrikewin/malicious_confidence_60% (W)
CyrenW32/MSIL_Kryptik.APC.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Kryptik.UMD
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan.MSIL.Crypt.gen
BitDefenderTrojan.GenericKD.38215413
AvastWin32:MalwareX-gen [Trj]
Ad-AwareTrojan.GenericKD.38215413
SophosMal/Generic-S
DrWebTrojan.MulDrop19.12540
McAfee-GW-EditionBehavesLike.Win32.BadFile.hh
EmsisoftTrojan.GenericKD.38215413 (B)
IkarusBackdoor.MSIL
GDataWin32.Trojan.Agent.YCAMT1
AviraHEUR/AGEN.1126750
GridinsoftRansom.Win32.Sabsik.sa
MicrosoftTrojan:Win32/Tiggre!rfn
CynetMalicious (score: 99)
AhnLab-V3Trojan/Win32.Crypt.R218495
McAfeeArtemis!0DFBA212A98F
MAXmalware (ai score=83)
MalwarebytesTrojan.Agent.PGen
TrendMicro-HouseCallTROJ_GEN.R002H0CL721
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_99%
FortinetMSIL/Generic.AP.137178!tr
BitDefenderThetaGen:NN.ZemsilF.34062.Km0@aKvMQEbe
AVGWin32:MalwareX-gen [Trj]
Cybereasonmalicious.bf39a3
PandaTrj/GdSda.A

How to remove MSIL/Kryptik.UMD?

MSIL/Kryptik.UMD removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment