What is “IL:Trojan.MSILMamut.12676”?

The IL:Trojan.MSILMamut.12676 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What IL:Trojan.MSILMamut.12676 virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine IL:Trojan.MSILMamut.12676?


File Info:
name: E3A05F5E66EFE0B9A151.mlw
path: /opt/CAPEv2/storage/binaries/7f21e13cab2b43c9c7354dc33226f4858b9dc360e155d5aa16b490ef9dcbd1d4
crc32: 0B16DAEE
md5: e3a05f5e66efe0b9a15158bf3ca41e78
sha1: 5beb25d7fc9f31b446431f1dde64780eaa5f62e1
sha256: 7f21e13cab2b43c9c7354dc33226f4858b9dc360e155d5aa16b490ef9dcbd1d4
sha512: 53f3b8583e4c9db2a67d83336b52d9f379edf056a80dd16b383dd5bc29e7c5e1287a4546f4421d6d73152f3751df6415d428d3a1fb9718b9ba48ababf80ad608
ssdeep: 768:Yih5CHEOLE4tyRiLWHtmgQBBBJEvXbcj+8I6eyaAD8VXQ3N/:YinC5tyRiLWHdQBBbEby+8I6etAwVA35
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19723E72133F49B25D1BD8BF9D4B2260507F1784B5432E7985E81B8CF6962FA48062FE7
sha3_384: 5e89934caaff9661209f9afbc4882cb8322671c343ca54bea70702a19ff652a8060151a2588bda3619514b18d16c3ae9
ep_bytes: ff250020400000000000000000000000
timestamp: 2046-12-14 08:52:39

Version Info:
Translation: 0x0000 0x04b0
Comments: KeyAuth Loader Winform Example
CompanyName: Nelson Cybersecurity LLC
FileDescription: Loader
FileVersion: 1.0.0.0
InternalName: Loader.exe
LegalCopyright: Copyright © KeyAuth.cc
LegalTrademarks: 
OriginalFilename: Loader.exe
ProductName: Loader
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

IL:Trojan.MSILMamut.12676 also known as:

MicroWorld-eScan	IL:Trojan.MSILMamut.12676
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
Skyhigh	PUP-XWC-EV
McAfee	PUP-XWC-EV
Malwarebytes	Trojan.MalPack.Confuser
Zillya	Tool.HackTool.Win32.8525
K7AntiVirus	Riskware ( 0059ca2f1 )
BitDefender	IL:Trojan.MSILMamut.12676
K7GW	Riskware ( 0059ca2f1 )
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/RiskWare.HackTool.Agent_AGen.S
APEX	Malicious
ClamAV	Win.Packed.Bulz-10008187-0
Rising	Hacktool.Agent!8.335 (TFE:dGZlOgzrmiVVWUN9kg)
VIPRE	IL:Trojan.MSILMamut.12676
FireEye	IL:Trojan.MSILMamut.12676
Emsisoft	IL:Trojan.MSILMamut.12676 (B)
Ikarus	PUA.RiskWare.Hacktool
Google	Detected
Varist	W32/MSIL_Agent.FYM.gen!Eldorado
Microsoft	PUA:Win32/Puwaders.C!ml
Arcabit	IL:Trojan.MSILMamut.D3184
GData	IL:Trojan.MSILMamut.12676
AhnLab-V3	Trojan/Win.Generic.C4585667
ALYac	IL:Trojan.MSILMamut.12676
MAX	malware (ai score=84)
DeepInstinct	MALICIOUS
TrendMicro-HouseCall	TROJ_GEN.R03BH0CJQ23
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.218758409.susgen
Fortinet	Riskware/HackTool
AVG	Win32:TrojanX-gen [Trj]
Avast	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove IL:Trojan.MSILMamut.12676?

IL:Trojan.MSILMamut.12676 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X