Should I remove “IL:Trojan.MSILMamut.3806”?

The IL:Trojan.MSILMamut.3806 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What IL:Trojan.MSILMamut.3806 virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous binary characteristics
Binary compilation timestomping detected

How to determine IL:Trojan.MSILMamut.3806?


File Info:
name: 111D14C334F7E48FACB3.mlw
path: /opt/CAPEv2/storage/binaries/03f20941b937647dbedd92e8e6853e05047f5d9e6f9d6057efedf077bc1b6a29
crc32: C9DC8CD6
md5: 111d14c334f7e48facb39ddcdd47246a
sha1: 4968e540ed58e30ca0f32cf1b5d0876c67e0950c
sha256: 03f20941b937647dbedd92e8e6853e05047f5d9e6f9d6057efedf077bc1b6a29
sha512: 32cf82dd8f7c379eb4be69c961c11a4bca3070d46b5d52668abc2d941e8fcbf6402916487a510d0198dfec0ecd4109e6af26873d621b8ca514a963c575c1da0b
ssdeep: 6144:AkuDnJteVZZrPeFZcKOsbBA4xQ7uhhq7p4Fe0ZCtVTduet4Bd3+p0gkWYNwc7n1S:AlrQiJBw7p4A3x4wkhwc51YawDUUnJ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A835C4987D248271C6B99B7AD5A3D2B423340C59E9ACC55738E73C8CBCE53D70A94A0F
sha3_384: cf295dc6e4f86440ce64a636e671baff814f6d829c7c0531456d9c4c64f545ff989e82c0fcc0dead556ca166b0abf0d1
ep_bytes: ff2500206d0000000000000000000000
timestamp: 2104-11-01 22:37:23

Version Info:
Translation: 0x0000 0x04b0
Comments: BEST COOKIES LOGS TOOLS
CompanyName: 
FileDescription: BLTools
FileVersion: 1.5.2.0
InternalName: CTools.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: boyring
OriginalFilename: CTools.exe
ProductName: BLTools by boyring
ProductVersion: 1.5.2.0
Assembly Version: 1.5.2.0

IL:Trojan.MSILMamut.3806 also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
FireEye	IL:Trojan.MSILMamut.3806
CAT-QuickHeal	Trojan.LazyFC.S27417019
ALYac	IL:Trojan.MSILMamut.3806
Arcabit	IL:Trojan.MSILMamut.DEDE
Symantec	ML.Attribute.HighConfidence
Kaspersky	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
BitDefender	IL:Trojan.MSILMamut.3806
MicroWorld-eScan	IL:Trojan.MSILMamut.3806
APEX	Malicious
Rising	Trojan.ClipBanker!8.5FB (TFE:dGZlOgyyxKi11BXOCA)
Ad-Aware	IL:Trojan.MSILMamut.3806
Emsisoft	IL:Trojan.MSILMamut.3806 (B)
DrWeb	Trojan.Siggen17.55748
VIPRE	IL:Trojan.MSILMamut.3806
McAfee-GW-Edition	GenericRXTI-AI!111D14C334F7
Jiangmin	Trojan.Banker.MSIL.gei
MAX	malware (ai score=87)
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
ZoneAlarm	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
GData	IL:Trojan.MSILMamut.3806
AhnLab-V3	Trojan/Win.Generic.C5018292
McAfee	GenericRXTI-AI!111D14C334F7
Malwarebytes	Trojan.ClipBanker
Avast	Win32:BankerX-gen [Trj]
SentinelOne	Static AI – Suspicious PE
AVG	Win32:BankerX-gen [Trj]

How to remove IL:Trojan.MSILMamut.3806?

IL:Trojan.MSILMamut.3806 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X