MSIL/Spy.Agent.DUO removal

The MSIL/Spy.Agent.DUO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Spy.Agent.DUO virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine MSIL/Spy.Agent.DUO?


File Info:
name: 6B4B4271822C08F586AD.mlw
path: /opt/CAPEv2/storage/binaries/ab4dbc0297933c740ca5c77b3ea1239b3d755a4391d5a94c3d7e8fc4d04f02af
crc32: AA4191AB
md5: 6b4b4271822c08f586ad740ff58a05a8
sha1: faaf1b7bedfd6875fa79b954c3b7879acf2422f7
sha256: ab4dbc0297933c740ca5c77b3ea1239b3d755a4391d5a94c3d7e8fc4d04f02af
sha512: fae907018c808eea3181711188c3e51c1c87a1ce18cec3f1bb6e0c99d3c270c9f43d476893719cfd5cc09267bbeda6e18378a76fa9509997d2a04a4c8010954d
ssdeep: 384:lCO7dpB4zRjqYqi7k7K8tal8as9Ht/Ozzk3PRYd0nJXt:vhpCFehi7P6L3edmJXt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AD72F81927EC866BC9BE0FBB8CB361504B71F41B9821EF591ED594492D72F408693F23
sha3_384: 8dc7fc80b2243f64874edb90c3c5e2551a9691cf1cc676fafc5fa83fcf46e345c55aa232e7c79c40a76728241a7304a2
ep_bytes: ff250020400000000000000000000000
timestamp: 2043-12-25 00:59:27

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: WindowsFormsApp25
FileVersion: 1.0.0.0
InternalName: rams.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: rams.exe
ProductName: WindowsFormsApp25
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Spy.Agent.DUO also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
Cylance	Unsafe
Alibaba	Trojan:MSIL/Generic.34e8b823
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Spy.Agent.DUO
APEX	Malicious
Avast	SpywareX-gen [Trj]
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.6b4b4271822c08f5
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Avira	TR/Dropper.MSIL.Gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 99)
McAfee	Artemis!6B4B4271822C
Malwarebytes	Spyware.PasswordStealer
TrendMicro-HouseCall	TROJ_GEN.R002H0ADU22
Fortinet	MSIL/Agent.DUO!tr.spy
BitDefenderTheta	Gen:NN.ZemsilF.34638.bm0@ayeuOGi
AVG	SpywareX-gen [Trj]

How to remove MSIL/Spy.Agent.DUO?

MSIL/Spy.Agent.DUO removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X