What is “MSIL/Rozena.DI”?

The MSIL/Rozena.DI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Rozena.DI virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/Rozena.DI?


File Info:
name: C07823C8AD1FE887CB91.mlw
path: /opt/CAPEv2/storage/binaries/0f4f468b7c598e04987a54fe2a0bf7a08212f4a6110ec71ad5706548a565e166
crc32: FF4B8EFE
md5: c07823c8ad1fe887cb91445cb32caf11
sha1: e15b7fefb230f46151184ca54b033f3cc6934c1b
sha256: 0f4f468b7c598e04987a54fe2a0bf7a08212f4a6110ec71ad5706548a565e166
sha512: 4e064239a99632915b29194a4f8a569e57d8226319fab973ba5510b4f40a9b0215a594b611d0a79085caaec711e0514e85cf10ca4d3ffd2d79e3ec3fe97c02b1
ssdeep: 48:6MtWjPc1hLB2qmNM3HFg87j/Mt7ta4sBwdswqOPulC0mRtI:0c1n73m8P/ka4gweU0mR
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T122B1B3175FE91A6BE477073149B3070B1AB4F4506B36679F16F0820A3C672605E62760
sha3_384: 90f6ef46e5e29aefc27886e56c9fd296557d6fc5ec6052146addd902f5455a32daf1fd5da8f9e18233855c1545c74bbb
ep_bytes: ff250020400000000000000000000000
timestamp: 1970-01-01 00:00:00

Version Info:
Translation: 0x007f 0x04b0
Comments:  
CompanyName:  
FileDescription:  
FileVersion: 0.0.0.0
InternalName: rev
LegalCopyright:  
LegalTrademarks:  
OriginalFilename: rev.exe
ProductName:  
ProductVersion:

MSIL/Rozena.DI also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.c07823c8ad1fe887
Malwarebytes	Trojan.Injector
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.fb230f
Cyren	W32/MSIL_Agent.AS.gen!Eldorado
ESET-NOD32	a variant of MSIL/Rozena.DI
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.Rozena.gen
Avast	Win32:TrojanX-gen [Trj]
F-Secure	Trojan.TR/Rozena.Gen
DrWeb	Trojan.InjectNET.42
Trapmine	malicious.moderate.ml.score
Sophos	ML/PE-A
Avira	TR/Rozena.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.MSIL.Rozena.gen
Google	Detected
Acronis	suspicious
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:pCc5uBRDB/YNzR0+Xj+ExA)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZemsilF.34606.aq0@amzhgAn
AVG	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_60% (D)

How to remove MSIL/Rozena.DI?

MSIL/Rozena.DI removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X