IL:Trojan.MSILMamut.27 removal tips

The IL:Trojan.MSILMamut.27 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What IL:Trojan.MSILMamut.27 virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Authenticode signature is invalid
CAPE detected the CrimsonRAT malware family

How to determine IL:Trojan.MSILMamut.27?


File Info:
name: 543E6753B0FCDB5099FF.mlw
path: /opt/CAPEv2/storage/binaries/ca74472613129855bd7fc79c4a245a2f27de85086cfd191506f1c9906b9ae460
crc32: 64AA7A78
md5: 543e6753b0fcdb5099ff718337f460ca
sha1: 561c10c491fc7823b99bf5102d878a3f15e6a90c
sha256: ca74472613129855bd7fc79c4a245a2f27de85086cfd191506f1c9906b9ae460
sha512: 753960c8d85199b1d30484c27af601b327bb2624fe8a1b2a11ff737d021ea5dd673edb1782713319e2e9d9e1060a0529d6d66f9c5371bd063351fbefc09d4950
ssdeep: 1536:E1wa7otTYoJ2wS13Bx7fIz6v3Wp9uxzub:E1sZYWS13BZfPfc6c
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T162A68140D34E631EEEEAC7798D211139F62FF59BD602A5CE054D9B4B19122B3C2AD31E
sha3_384: c406a0fae403483e9491b3f71d0b655cb83a6d0a54992c79775b920d475eedd9c27c4b1c38292c7940c72cebc69aae55
ep_bytes: ff250020400000000000000000000000
timestamp: 2019-12-15 08:35:09

Version Info:
Translation: 0x0000 0x04b0
FileDescription: vidhagirea
FileVersion: 1.0.0.0
InternalName: vidhagirea.exe
LegalCopyright: Copyright ©  2019
OriginalFilename: vidhagirea.exe
ProductName: vidhagirea
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

IL:Trojan.MSILMamut.27 also known as:

MicroWorld-eScan	IL:Trojan.MSILMamut.27
FireEye	Generic.mg.543e6753b0fcdb50
Malwarebytes	Backdoor.CrimsonRAT.Generic
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0053965f1 )
K7GW	Trojan ( 0053965f1 )
Cybereason	malicious.3b0fcd
Symantec	Trojan.Scarimson!gm
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.BNY
ClamAV	Win.Trojan.CrimsonRAT-7591455-0
Kaspersky	HEUR:Backdoor.MSIL.CrimsonRat.gen
BitDefender	IL:Trojan.MSILMamut.27
Avast	Win32:BackdoorX-gen [Trj]
Ad-Aware	IL:Trojan.MSILMamut.27
Emsisoft	IL:Trojan.MSILMamut.27 (B)
DrWeb	BackDoor.SpyBotNET.47
VIPRE	IL:Trojan.MSILMamut.27
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
GData	IL:Trojan.MSILMamut.27
Google	Detected
Avira	TR/Spy.Gen
Arcabit	IL:Trojan.MSILMamut.27
ZoneAlarm	HEUR:Backdoor.MSIL.CrimsonRat.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win32.RL_Generic.C4268806
ALYac	IL:Trojan.MSILMamut.27
MAX	malware (ai score=89)
Yandex	Trojan.Agent!20QYC43JUqg
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.ATP!tr
BitDefenderTheta	Gen:NN.ZemsilF.34646.@p2@aqtDgjc
AVG	Win32:BackdoorX-gen [Trj]

How to remove IL:Trojan.MSILMamut.27?

IL:Trojan.MSILMamut.27 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X