Categories: Ransom

Ransom:MSIL/Khonsari.A information

The Ransom:MSIL/Khonsari.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom:MSIL/Khonsari.A virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
CAPE detected the Khonsari malware family
Binary compilation timestomping detected

How to determine Ransom:MSIL/Khonsari.A?


File Info:
name: 6AC57A1E090E7ABDB9B7.mlwpath: /opt/CAPEv2/storage/binaries/f2e3f685256e5f31b05fc9f9ca470f527d7fdae28fa3190c8eba179473e20789crc32: 65A3A7B5md5: 6ac57a1e090e7abdb9b7212e058c43c6sha1: 0a1e239348a73b1a95ac1767c8afebe4b98cdeffsha256: f2e3f685256e5f31b05fc9f9ca470f527d7fdae28fa3190c8eba179473e20789sha512: 95748e2a5c90440206a815960eb864b787562d9dbe5d57a3279ef71d24143ff6f0f963925836623bfcb02914c0c0dea3cc0f731860c88101710659c445287a9essdeep: 384:uo95XKnTPKv8CtjGdcYprMRpEvA1SXs/177:phKTPCtF5SXst77type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T19942D60566A89736C2FA0F79CCA3875103B1D7A1D977CF1E3CC8A21A9C9274447936BAsha3_384: c613a77a556db0c8b11349accc7c0eacb82d9a667fa2557992763018990876881438dd06e78ba68faa7b8621034dcc23ep_bytes: ff250020400000000000000000000000timestamp: 2067-12-22 02:27:27
Version Info:
Translation: 0x0000 0x04b0Comments: CompanyName: FileDescription: FecitAntiquesFileVersion: 1.0.0.0InternalName: FecitAntiques.exeLegalCopyright: Copyright ©  2021LegalTrademarks: OriginalFilename: FecitAntiques.exeProductName: FecitAntiquesProductVersion: 1.0.0.0Assembly Version: 1.0.0.0

Ransom:MSIL/Khonsari.A also known as:

Lionic	Trojan.MSIL.Encoder.j!c
Elastic	malicious (high confidence)
DrWeb	Trojan.EncoderNET.31
MicroWorld-eScan	Trojan.GenericKD.38255775
FireEye	Generic.mg.6ac57a1e090e7abd
ALYac	Trojan.Ransom.Filecoder
Sangfor	Ransom.MSIL.Encoder.gen
K7AntiVirus	Trojan ( 0058bc941 )
BitDefender	Trojan.GenericKD.38255775
K7GW	Trojan ( 0058bc941 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34160.am0@aqcMuqf
VirIT	Ransom.Win32.Khonsari.DED
Cyren	W32/Ransom.RVBX-1540
Symantec	Ransom.Khonsari
ESET-NOD32	a variant of MSIL/Filecoder.ANF
TrendMicro-HouseCall	Ransom.MSIL.KHONSARI.YXBLN
Paloalto	generic.ml
ClamAV	Win.Trojan.Khonsari-9915806-0
Kaspersky	HEUR:Trojan-Ransom.MSIL.Encoder.gen
Alibaba	Ransom:MSIL/Khonsari.32ea6fea
ViRobot	Trojan.Win32.S.Khonsari.12800
Rising	Trojan.Generic/MSIL@AI.91 (RDM.MSIL:VRn24xfNPr7HZHwyetYeZw)
Ad-Aware	Trojan.GenericKD.38255775
Sophos	Mal/Generic-R + Troj/Khonsari-A
Comodo	Malware@#vh4pdgmvoxs8
F-Secure	Heuristic.HEUR/AGEN.1109374
Zillya	Trojan.Filecoder.Win32.21238
TrendMicro	Ransom.MSIL.KHONSARI.YXBLN
McAfee-GW-Edition	RDN/Ransom
Emsisoft	Trojan.GenericKD.38255775 (B)
Ikarus	Trojan.SuspectCRC
Jiangmin	Trojan.MSIL.alqnk
Webroot	W32.Ransom.Khonsari
Avira	HEUR/AGEN.1109374
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Generic.ASSuf.4192A
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Ransom:MSIL/Khonsari.A
GData	MSIL.Trojan-Ransom.Khonsari.A
Cynet	Malicious (score: 100)
AhnLab-V3	Ransomware/Win.Khonsari.R458604
McAfee	RDN/Ransom
VBA32	TScope.Trojan.MSIL
Panda	Trj/GdSda.A
APEX	Malicious
Tencent	Msil.Trojan.Encoder.Wsan
Yandex	Trojan.Agent!0tKxNeW9714
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Filecoder.ANF!tr.ransom
AVG	Win32:RansomX-gen [Ransom]
Avast	Win32:RansomX-gen [Ransom]