MSIL/Kryptik.WLJ removal

The MSIL/Kryptik.WLJ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Kryptik.WLJ virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Attempts to connect to a dead IP:Port (5 unique times)
Drops a binary and executes it
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Steals private information from local Internet browsers
Attempts to modify proxy settings
Attempts to access Bitcoin/ALTCoin wallets
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Collects information to fingerprint the system

Related domains:

tunnabelly.ug

telete.in

apps.identrust.com

aaronthompson.ug

How to determine MSIL/Kryptik.WLJ?


File Info:
crc32: 8779C9F5
md5: 0c59a5c407d83766d234d7633064d656
name: az2.exe
sha1: 5eee9b7d016ad9ae8c37e61a6c0d12240acf9e76
sha256: 573f11821c72786131d82bcdb3744b83d01615c25489f4cf2c46181ae6143226
sha512: 338cc0743cd8c506ac65d741aa621c92bfc986c6eeec70bfe8481157ff81a7c3f862cd9544533fb06599b25b4b148b013308c53343c11986a4a479912963c2b7
ssdeep: 6144:rUIJa/vCVDkGhTkARi1ssTbbIRj2X2sgzUuBuIW:tKaDkGNLRi7XIRjIEUuY
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2020
Assembly Version: 1.0.0.0
InternalName: EkYXbI.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: lexCalculator
ProductVersion: 1.0.0.0
FileDescription: lexCalculator
OriginalFilename: EkYXbI.exe

MSIL/Kryptik.WLJ also known as:

DrWeb	Trojan.PWS.Siggen2.50958
MicroWorld-eScan	Trojan.GenericKD.34051657
FireEye	Generic.mg.0c59a5c407d83766
McAfee	Artemis!0C59A5C407D8
Cylance	Unsafe
BitDefender	Trojan.GenericKD.34051657
TrendMicro	TROJ_GEN.R054C0WFL20
BitDefenderTheta	Gen:NN.ZemsilF.34128.pm0@aKBht@e
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
GData	Win32.Trojan-Stealer.Azorult.ED8U69
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
Alibaba	TrojanSpy:MSIL/Kryptik.25d77214
Endgame	malicious (high confidence)
Emsisoft	Trojan.GenericKD.34051657 (B)
F-Secure	Trojan.TR/Kryptik.vypyx
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Crypt
Avira	TR/Kryptik.vypyx
Arcabit	Trojan.Generic.D2079649
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
Microsoft	TrojanSpy:Win32/Banload.AAA!bit
MAX	malware (ai score=89)
Malwarebytes	Trojan.MalPack.DFD.Generic
Panda	Trj/GdSda.A
ESET-NOD32	a variant of MSIL/Kryptik.WLJ
TrendMicro-HouseCall	TROJ_GEN.R054C0WFL20
Rising	Stealer.Azorult!8.11176 (CLOUD)
eGambit	Unsafe.AI_Score_52%
Fortinet	MSIL/Kryptik.WLJ!tr
Ad-Aware	Trojan.GenericKD.34051657
AVG	Win32:PWSX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_70% (W)
MaxSecure	Trojan.Malware.300983.susgen

How to remove MSIL/Kryptik.WLJ?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.