Malware

MSIL/Kryptik.XRP (file analysis)

Malware Removal

The MSIL/Kryptik.XRP is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL/Kryptik.XRP virus can do?

  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous .NET characteristics

How to determine MSIL/Kryptik.XRP?



File Info:

name: ED7B2F2988A1EEBE1EBD.mlw
path: /opt/CAPEv2/storage/binaries/a50555dfbc7cb529744477090adc6568fe98caa76f676dcf9a1d8fe9ab304e57
crc32: 0808AF0C
md5: ed7b2f2988a1eebe1ebdcd43bcf6e7d0
sha1: 1e2bab56bb55ec906c60b33eba68685d0673e024
sha256: a50555dfbc7cb529744477090adc6568fe98caa76f676dcf9a1d8fe9ab304e57
sha512: a8c40c7d86e290bf012b3df6bde1c7c089a38b1c588a43b1135e381aced60270bb48edc12190a89433631e51a1441990ae59ffa7889a2db104fe16b191e2277b
ssdeep: 12288:QQzgBaA1Wh2zOXM4bbaq87DPLDMPdSM1gADPv:lDMMb987D/MPQMP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FDA4D000B36E4F36EAF847F95569345427F2202EA836E35DACC9A0DE57BBF500695B03
sha3_384: cec5bdc6a711b5a9bfc8c622d2e70b69fc806769d26617e6631cbf5c592d98496201cea7824d50435f22b6c67ec41eec
ep_bytes: ff250020400000000000000000000000
timestamp: 2020-09-10 01:00:04


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: MSI
FileDescription: CC Engine
FileVersion: 1.0.0.0
InternalName: 4Ry.exe
LegalCopyright: Copyright (C) 2018 Micro-Star INT'L CO., LTD.
LegalTrademarks: 
OriginalFilename: 4Ry.exe
ProductName: CC Engine
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Kryptik.XRP also known as:

BkavW32.AIDetectMalware.CS
LionicTrojan.Multi.Generic.4!c
MicroWorld-eScanTrojan.GenericKDZ.69988
FireEyeGeneric.mg.ed7b2f2988a1eebe
CAT-QuickHealTrojan.MsilFC.S15904370
SkyhighBehavesLike.Win32.Generic.gc
ALYacTrojan.GenericKDZ.69988
Cylanceunsafe
VIPRETrojan.GenericKDZ.69988
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 005690671 )
AlibabaTrojanSpy:MSIL/AgentTesla.242f9824
K7GWTrojan ( 005690671 )
Cybereasonmalicious.988a1e
SymantecPacked.Generic.570
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Kryptik.XRP
APEXMalicious
AvastWin32:MalwareX-gen [Trj]
KasperskyHEUR:Trojan.MSIL.Taskun.gen
BitDefenderTrojan.GenericKDZ.69988
NANO-AntivirusTrojan.Win32.Taskun.huplpi
EmsisoftTrojan.Crypt (A)
F-SecureHeuristic.HEUR/AGEN.1306279
DrWebTrojan.Inject3.58449
Trapminemalicious.high.ml.score
SophosTroj/Krypt-ABH
IkarusTrojan.MSIL.Inject
GDataTrojan.GenericKDZ.69988
VaristW32/MSIL_Kryptik.BOU.gen!Eldorado
AviraHEUR/AGEN.1306279
MAXmalware (ai score=100)
Antiy-AVLTrojan/MSIL.Taskun
Kingsoftmalware.kb.c.993
XcitiumMalware@#3fyl4jq9euf8z
ArcabitTrojan.Generic.D11164
ZoneAlarmHEUR:Trojan.MSIL.Taskun.gen
MicrosoftTrojanSpy:MSIL/AgentTesla.PBU!MTB
GoogleDetected
AhnLab-V3Trojan/Win32.Lokibot.R350904
McAfeeFareit-FZV!ED7B2F2988A1
VBA32TScope.Trojan.MSIL
MalwarebytesGeneric.Malware.AI.DDS
PandaTrj/GdSda.A
RisingMalware.Obfus/MSIL@AI.100 (RDM.MSIL2:6YB2YLiflzfs1lu49MvF2Q)
SentinelOneStatic AI – Malicious PE
FortinetMSIL/Kryptik.XUA!tr
AVGWin32:MalwareX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)
alibabacloudTrojan:MSIL/Kryptik.XRP

How to remove MSIL/Kryptik.XRP?

MSIL/Kryptik.XRP removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment