Should I remove “MSIL:Crypt-YW [Trj]”?

The MSIL:Crypt-YW [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL:Crypt-YW [Trj] virus can do?

Dynamic (imported) function loading detected
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL:Crypt-YW [Trj]?


File Info:
name: 8E73047E2270A37E69E5.mlw
path: /opt/CAPEv2/storage/binaries/fe72f522c7d21fa0061b6b7e7bf0c755c244f8f3087141796542ba629ab4dd57
crc32: D2960782
md5: 8e73047e2270a37e69e55b41ff3d7251
sha1: b9eba05568488439b896705e5deb150f9ecfa3e4
sha256: fe72f522c7d21fa0061b6b7e7bf0c755c244f8f3087141796542ba629ab4dd57
sha512: 167152da6dcc43608068e1110d970cc1c0caa44a7384c9c38a2dcd3083c5930276c05afab91ced1166538543e4c8d8a992f2d16b8e478cb76dfc2745a14765d3
ssdeep: 6144:jSgOWzbgoqaJE4POhJrkTXYVVEjO+/uG:e9WtJE4P8JGIHEjO+/uG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D454C06376D89210C41414B685EF863403E2BF427BB3D6673E8577DE2EB93D29C8478A
sha3_384: 8b4b0c6c05183c76dd138a3075b4509907534899eaff68fe35539699a87a94aa2bb864fd54180cdb666bb66859cfa353
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-01-22 08:26:14

Version Info:
CompanyName: KADOKAWA
FileDescription: game
InternalName: game_exe
LegalCopyright: Copyright 2017 Kadokawa. All rights reserved.
OriginalFilename: game.exe
ProductName: game
CompanyShortName: kadokawa
ProductShortName: kadokawa
LastChange: 15b9f145354d863c03cebb6fb2d992d4213b9a05-
Translation: 0x0409 0x04b0

MSIL:Crypt-YW [Trj] also known as:

Lionic	Trojan.Win32.Malicious.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Mardom.MN.15
FireEye	Generic.mg.8e73047e2270a37e
McAfee	Artemis!8E73047E2270
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 004d61561 )
Alibaba	Trojan:MSIL/Injector.195e82e5
K7GW	Trojan ( 004d61561 )
Cybereason	malicious.568488
BitDefenderTheta	Gen:NN.ZemsilF.34182.sq0@aS4txani
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.MAR
TrendMicro-HouseCall	TROJ_GEN.R04AH0CB322
Paloalto	generic.ml
BitDefender	Gen:Trojan.Mardom.MN.15
Avast	MSIL:Crypt-YW [Trj]
Rising	Malware.Obfus/MSIL@AI.96 (RDM.MSIL:sPaS7n2JqmWRzdKxH8jPuA)
Emsisoft	Gen:Trojan.Mardom.MN.15 (B)
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Injector
Avira	HEUR/AGEN.1105306
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Tiggre!rfn
GData	Gen:Trojan.Mardom.MN.15
Cynet	Malicious (score: 100)
MAX	malware (ai score=87)
Cylance	Unsafe
APEX	Malicious
Tencent	Win32.Trojan.Mardom.Ednv
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/MAR!tr
AVG	MSIL:Crypt-YW [Trj]
CrowdStrike	win/malicious_confidence_70% (W)

How to remove MSIL:Crypt-YW [Trj]?

MSIL:Crypt-YW [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X