Ransom:MSIL/Trycrypt malicious file

The Ransom:MSIL/Trycrypt is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom:MSIL/Trycrypt virus can do?

The binary likely contains encrypted or compressed data.

How to determine Ransom:MSIL/Trycrypt?


File Info:
crc32: 5C6D3842
md5: 0ef32448977f129fb52fc2e542fff15a
name: 0EF32448977F129FB52FC2E542FFF15A.mlw
sha1: 1c41b61af78c45ccadeefd85e68c6ad41b860809
sha256: 7c26e01b1962c20ad1a83252b5500f97801389c9d60c839d4b28bccf57a974c5
sha512: 72505aa96b18856db9962f7b009a4aabf7748874b06cfe912de433820cdc3e697bc5cab679046f35d71261a58a83ef7c0d67d9f3217fa5aa03c883c850118f97
ssdeep: 3072:0+EhBFvN3/WFhXt/wrCVvAjwehA8naRS9hALuvoi:boBIh2rCVI0OA8nRDQs
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2017
Assembly Version: 1.0.0.0
InternalName: program1.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: program1
ProductVersion: 1.0.0.0
FileDescription: program1
OriginalFilename: program1.exe

Ransom:MSIL/Trycrypt also known as:

K7AntiVirus	Riskware ( 0040eff71 )
Cynet	Malicious (score: 85)
ALYac	Trojan.Ransom.CardSome
Sangfor	Trojan.Win32.Save.a
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.8977f1
ESET-NOD32	a variant of Generik.INIWTZ
APEX	Malicious
Avast	Win32:Malware-gen
BitDefender	Generic.FakeRans.B8417E1B
NANO-Antivirus	Trojan.Win32.RedCap.fclmlq
MicroWorld-eScan	Generic.FakeRans.B8417E1B
Tencent	Win32.Trojan.Generic.Kzr
Ad-Aware	Generic.FakeRans.B8417E1B
Sophos	Mal/Ramsil-P
BitDefenderTheta	Gen:NN.ZemsilF.34608.im0@a0uX7No
McAfee-GW-Edition	GenericRXDT-LR!0EF32448977F
FireEye	Generic.FakeRans.B8417E1B
Emsisoft	Generic.FakeRans.B8417E1B (B)
SentinelOne	Static AI – Suspicious PE
Avira	HEUR/AGEN.1137282
Microsoft	Ransom:MSIL/Trycrypt
AegisLab	Trojan.Win32.Generic.4!c
GData	Generic.FakeRans.B8417E1B
McAfee	GenericRXDT-LR!0EF32448977F
MAX	malware (ai score=94)
Malwarebytes	MachineLearning/Anomalous.93%
Panda	Trj/GdSda.A
Fortinet	W32/Ramsil.P!tr
AVG	Win32:Malware-gen

How to remove Ransom:MSIL/Trycrypt?

Ransom:MSIL/Trycrypt removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X