Categories: Spy

MSIL/Spy.Keylogger.AZW (file analysis)

The MSIL/Spy.Keylogger.AZW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Spy.Keylogger.AZW virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Sniffs keystrokes
Unusual version info supplied for binary

How to determine MSIL/Spy.Keylogger.AZW?


File Info:
name: B55A7DA332BED90E7983.mlwpath: /opt/CAPEv2/storage/binaries/a168f0d23858657671ade1a151551dade4ee9d1f91e42fe40b614a456681d849crc32: 771DFD5Emd5: b55a7da332bed90e798313b968ce7819sha1: 21d3fddba0461a89605a459bd1f7f464b256ed2asha256: a168f0d23858657671ade1a151551dade4ee9d1f91e42fe40b614a456681d849sha512: e16e28f3cc08d10358a4e4569918f359ec5d8eabc7cd77941f5e396c89596e247fe6eb7a374690e4ed044ec029a3054b5eb856ecb8286b1aeb8b437624ae4499ssdeep: 384:A74eQc8QTL354TfnQNAXfK5v3C3j1v2QOLSEI/wQzF+mMVCPw/aPNs:A7ZyNvKZC3j5OLSEIPHw/aNstype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1F692B54833EC429BDA7C8B7FC5B093102372A7535C2ACDBE4DE6814B285B364A553E5Bsha3_384: 54485d2c4a3d9b7b651da1eba335678fb7ab9fbac4cdd645425c8cf30a1e9d1120deba8615825884d90054d856be47ccep_bytes: ff250020400000000000000000000000timestamp: 2015-08-15 18:50:56
Version Info:
Translation: 0x0000 0x04b0CompanyName: GoogleFileDescription: Google ChromeFileVersion: 1.0.0.0InternalName: chromes.exeLegalCopyright: Google Chrome Copyright © Microsoft 2015OriginalFilename: chromes.exeProductName: GoogleProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

MSIL/Spy.Keylogger.AZW also known as:

Lionic	Trojan.MSIL.Keylogger.l!c
MicroWorld-eScan	IL:Trojan.MSILZilla.8300
FireEye	Generic.mg.b55a7da332bed90e
CAT-QuickHeal	TrojanAPT.MsoGen.A3
VIPRE	MSIL.Spy.Keylogger
CrowdStrike	win/malicious_confidence_60% (W)
BitDefender	IL:Trojan.MSILZilla.8300
K7GW	Spyware ( 0055e3ec1 )
K7AntiVirus	Spyware ( 0055e3ec1 )
Symantec	Trojan.Gen
ESET-NOD32	a variant of MSIL/Spy.Keylogger.AZW
APEX	Malicious
Kaspersky	Trojan-Spy.MSIL.Keylogger.jmv
Alibaba	TrojanSpy:MSIL/Keylogger.9b3a973f
NANO-Antivirus	Trojan.Win32.Keylog.ebssao
Rising	Trojan.Generic/MSIL@AI.90 (RDM.MSIL:E7CEBI+QgQ88KXIpXUIsTw)
Ad-Aware	IL:Trojan.MSILZilla.8300
Emsisoft	IL:Trojan.MSILZilla.8300 (B)
Comodo	Malware@#l7yryy9vtelx
TrendMicro	Backdoor.MSIL.CRIMSONRAT.L
Sophos	Generic PUA CB (PUA)
SentinelOne	Static AI – Suspicious PE
Jiangmin	TrojanSpy.MSIL.anll
Avira	HEUR/AGEN.1203642
Antiy-AVL	Trojan/Generic.ASMalwS.155A0AB
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
ZoneAlarm	Trojan-Spy.MSIL.Keylogger.jmv
GData	IL:Trojan.MSILZilla.8300
AhnLab-V3	Trojan/Win32.KeyLogger.C4220755
BitDefenderTheta	Gen:NN.ZemsilF.34212.bm0@a0HUDAk
ALYac	Trojan.Spy.MSIL.Crimson
VBA32	TScope.Trojan.MSIL
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Backdoor.MSIL.CRIMSONRAT.L
Tencent	Msil.Trojan-spy.Keylogger.Pefq
MAX	malware (ai score=100)
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Malware-gen
Cybereason	malicious.332bed
Paloalto	generic.ml