IL:Trojan.MSILMamut.5114 removal instruction

The IL:Trojan.MSILMamut.5114 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What IL:Trojan.MSILMamut.5114 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine IL:Trojan.MSILMamut.5114?


File Info:
name: D2E9A9B87773DCEA39E2.mlw
path: /opt/CAPEv2/storage/binaries/05eaba4be16f91bfe177b1489663ee622721277c6aa11f56061f92af3b1c2e8c
crc32: B80F7C27
md5: d2e9a9b87773dcea39e23cd732c22da7
sha1: 29625db4452a53c4847a6f9743487268a2bbbeb3
sha256: 05eaba4be16f91bfe177b1489663ee622721277c6aa11f56061f92af3b1c2e8c
sha512: 94a2e36851824ac049e90b40e6931b9730de58cc634989052f7505f8b388f2f3942d6b8c846701bfe23485e8a5d0ad70159c2e67b9f194fcc170c1b111a3c1ca
ssdeep: 6144:lBRxvRZVLlfh7rZthO+JjkuHEEAt/wz/60baxHUdzT7:lBRZdfrXg+JwuKt/S/6059
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T11A94E14471984801EB7FAAFF74B1B226097EBE47981AE77B588C73E91D723138814727
sha3_384: a3bdc7ddebf7b81b332ace9f247bd1b7cb12abcfa796a42b3d3cb634b1d89508ae8280eee1706726d6013ee14b4530cf
ep_bytes: ff250020400000000000000000000000
timestamp: 2058-04-22 19:59:54

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: RefundExploit
FileVersion: 1.5.0.0
InternalName: refundExploit.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: refundExploit.exe
ProductName: refundExploit
ProductVersion: 1.5.0.0
Assembly Version: 1.5.0.0

IL:Trojan.MSILMamut.5114 also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	IL:Trojan.MSILMamut.5114
BitDefender	IL:Trojan.MSILMamut.5114
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GameHack.CFJ potentially unsafe
APEX	Malicious
MicroWorld-eScan	IL:Trojan.MSILMamut.5114
Ad-Aware	IL:Trojan.MSILMamut.5114
Emsisoft	IL:Trojan.MSILMamut.5114 (B)
VIPRE	IL:Trojan.MSILMamut.5114
Ikarus	Trojan-Ransom.FileCrypter
GData	IL:Trojan.MSILMamut.5114
Arcabit	IL:Trojan.MSILMamut.D13FA
Microsoft	Program:Win32/Wacapew.C!ml
ALYac	IL:Trojan.MSILMamut.5114
MAX	malware (ai score=85)
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen

How to remove IL:Trojan.MSILMamut.5114?

IL:Trojan.MSILMamut.5114 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X