About “Spyware.Stealer.MSIL” infection

The Spyware.Stealer.MSIL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Spyware.Stealer.MSIL virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Attempts to connect to a dead IP:Port (1 unique times)
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Deletes its original binary from disk
• Sniffs keystrokes
• Collects and encrypts information about the computer likely to send to C2 server
• Installs itself for autorun at Windows startup
• Creates a copy of itself

How to determine Spyware.Stealer.MSIL?

File Info:
name: 8C334EE2181F8E270911.mlw
path: /opt/CAPEv2/storage/binaries/96800d48b87da849ad3b04633871fb48f68496f5a1e99992529547f756889772
crc32: 214D8D02
md5: 8c334ee2181f8e2709111ec4cd648096
sha1: 14189715e3e12ba974f56fb9b2f7a0e70c923c96
sha256: 96800d48b87da849ad3b04633871fb48f68496f5a1e99992529547f756889772
sha512: 5afde13a2d2da4f7207b48c3ef30eb1336c1773bc5ead69618bbd10a181d4aee28cc1ecc3cc024ab8c63f8e66fc08fbda479fe6ff67a77074ab1637b9ba74732
ssdeep: 768:75jtVUC2ixB7bHo9ChEBv5Ps62vEjdwmXOAcVXYLxZ7kzS:7LVKo85BBvr3Jc5YFZ7kzS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D223290877E91A10E0FE8AB985B1C110833ABA837912EF1D0DD5509A2A377D9CF55FA7
sha3_384: 0f4859b3756d3b30c73cc200b1d300797d6a49520a1034d92c97fed63b53866f3c6944faaf137f9d943e35019c236ae6
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-09-28 22:15:12

Version Info:
Translation: 0x0000 0x04b0
Comments: Device Association Framework Provider Host
CompanyName: Microsoft Corporation
FileDescription: Device Association Framework Provider Host
FileVersion: 10.0.1.10536
InternalName: dasHost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
LegalTrademarks: © Microsoft Corporation. All rights reserved.
OriginalFilename: dasHost.exe
ProductName: Device Association Framework Provider Host
ProductVersion: 10.0.1.10536
Assembly Version: 10.0.1.10536

Spyware.Stealer.MSIL also known as:

How to remove Spyware.Stealer.MSIL?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.