About “VirTool:MSIL/Obfuscator.AY” infection

The VirTool:MSIL/Obfuscator.AY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VirTool:MSIL/Obfuscator.AY virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Network activity detected but not expressed in API logs

How to determine VirTool:MSIL/Obfuscator.AY?


File Info:
crc32: D928BFF8
md5: 80b0ff775b67f3be34b58a5350bbbb55
name: 80B0FF775B67F3BE34B58A5350BBBB55.mlw
sha1: 0c817aa5522049c37f97fe6e398840b272dd352d
sha256: 71c9e84bb7a94203f2c701ee923463e68dab2006fe4ff87d7590dd28d1411993
sha512: 8f8bd5a22199d0908f7e22c800dc4d930323beffb15d23c6deffa8516285872d0c615c86cb5785c14ee0d01b9130c6f2cba5ca6f8a1add761eebf758f237ed0c
ssdeep: 3072:QwlMK12d8vkeLkRL6xyp4yBlO1LCcFW+leKGfO/UsMK8WworBKJRjhmjDVuPsFL:Q
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright:  
Assembly Version: 1.0.0.0
InternalName: M.exe
FileVersion: 1
ProductVersion: 1
FileDescription:  
OriginalFilename: M.exe

VirTool:MSIL/Obfuscator.AY also known as:

Elastic	malicious (high confidence)
FireEye	Generic.mg.80b0ff775b67f3be
McAfee	RDN/Generic.grp
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 00512d5d1 )
BitDefender	Gen:Variant.MSILPerseus.3670
K7GW	Trojan ( 00512d5d1 )
CrowdStrike	win/malicious_confidence_100% (D)
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	MSIL:GenMalicious-BXA [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
NANO-Antivirus	Trojan.Win32.Crypt.iirzeb
MicroWorld-eScan	Gen:Variant.MSILPerseus.3670
Ad-Aware	Gen:Variant.MSILPerseus.3670
Sophos	ML/PE-A + Troj/MSIL-ILJ
F-Secure	Trojan.TR/Dropper.MSIL.Gen
TrendMicro	TROJ_GEN.R014C0DAR21
McAfee-GW-Edition	BehavesLike.Win32.Generic.dz
Emsisoft	Gen:Variant.MSILPerseus.3670 (B)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Avira	TR/Dropper.MSIL.Gen
MAX	malware (ai score=85)
Microsoft	VirTool:MSIL/Obfuscator.AY
Arcabit	Trojan.MSILPerseus.DE56
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Gen:Variant.MSILPerseus.3670
AhnLab-V3	Trojan/Win32.Agent.R122150
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.34804.om0@aaBGPTd
ALYac	Gen:Variant.MSILPerseus.3670
Malwarebytes	Backdoor.Bladabindi
ESET-NOD32	a variant of MSIL/Injector.FRJ
TrendMicro-HouseCall	TROJ_GEN.R014C0DAR21
Ikarus	Trojan.MSIL.Injector
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Injector.FRJ!tr
AVG	MSIL:GenMalicious-BXA [Trj]
Cybereason	malicious.75b67f
Qihoo-360	HEUR/QVM03.0.0EE9.Malware.Gen

How to remove VirTool:MSIL/Obfuscator.AY?

VirTool:MSIL/Obfuscator.AY removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X