What is “Trojan.MSIL.Crypt.bhey”?

The Trojan.MSIL.Crypt.bhey is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.MSIL.Crypt.bhey virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with SmartAssembly
Authenticode signature is invalid

How to determine Trojan.MSIL.Crypt.bhey?


File Info:
name: F043155F1767516E46D0.mlw
path: /opt/CAPEv2/storage/binaries/3206eec67005829d869a7157088595b4105d64d79a094134a5a1a1539bedab8f
crc32: EED3C6A9
md5: f043155f1767516e46d083364fc21a05
sha1: 374f73558d17488376a4287d4fbcfe3511c134f3
sha256: 3206eec67005829d869a7157088595b4105d64d79a094134a5a1a1539bedab8f
sha512: ae05f61623072e5a286ee9cd9678f5786dceeb2b08bb11c1f348cd960babb13ec694e282416a0a96eedf8ef3083d3a39a4ca8f9a4b915ffdc4984db8c33043a2
ssdeep: 1536:gFYp/UpBvorOw4ogs+teNvXGnFd81D60OA8FJ0OA8FkcSeUybFrYU44jM5Eyl59R:gGSvDuvqYD62U2d9tzxH4Qxa0d9QKZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17B74DD223E8F95D0CE390D798291130B62FAC7EFED80AF2D2CA93895D49D6787C5B145
sha3_384: f187e39106c55f9dedd708458e41a153d009e7d0dd3055edaf51cd53cb79d5b08151ff02cd2c193abad2df4c42348665
ep_bytes: ff250020400000000000000000000000
timestamp: 2015-05-29 19:54:03

Version Info:
ProductName: aPikv93tUc2tgPZX
FileDescription: aiYeuEoQtzZ
CompanyName: aYE6JFnThnjy3
LegalCopyright: Copyright © 2011
LegalTrademarks: aLNU9Iq87GZVDp91gS
Comments: 
FileVersion: 11.15.18.75
ProductVersion: 11.15.18.75
Translation: 0x0000 0x04e4

Trojan.MSIL.Crypt.bhey also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Starter.4559
MicroWorld-eScan	Gen:Trojan.Mardom.PN.16
FireEye	Generic.mg.f043155f1767516e
McAfee	RDN/Generic.rp
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 00496bb91 )
K7GW	Trojan ( 00496bb91 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34606.vm0@aecMDqni
VirIT	Trojan.Win32.MSIL8.NLZ
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/Injector.DBE
APEX	Malicious
ClamAV	Win.Packed.Generic-9808464-0
Kaspersky	Trojan.MSIL.Crypt.bhey
BitDefender	Gen:Trojan.Mardom.PN.16
Avast	Win32:Trojan-gen
Tencent	Malware.Win32.Gencirc.114cc5de
Ad-Aware	Gen:Trojan.Mardom.PN.16
Emsisoft	Gen:Trojan.Mardom.PN.16 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.fh
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Ibashade
Avira	HEUR/AGEN.1208600
Microsoft	Trojan:Win32/Skeeyah.A!rfn
GData	Gen:Trojan.Mardom.PN.16
Cynet	Malicious (score: 100)
Acronis	suspicious
ALYac	Gen:Trojan.Mardom.PN.16
MAX	malware (ai score=81)
Malwarebytes	Malware.AI.3913745126
Rising	Malware.Obfus/MSIL@AI.90 (RDM.MSIL:cRtrIshZlNYGHCj7CDwTzg)
Yandex	Trojan.Crypt!drKOrurBeHQ
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/DBE!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.f17675
Panda	Trj/CI.A

How to remove Trojan.MSIL.Crypt.bhey?

Trojan.MSIL.Crypt.bhey removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X