IL:Trojan.MSILMamut.51623 removal instruction

The IL:Trojan.MSILMamut.51623 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What IL:Trojan.MSILMamut.51623 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine IL:Trojan.MSILMamut.51623?


File Info:
name: B45CFC7E1519883523BA.mlw
path: /opt/CAPEv2/storage/binaries/010944a97404854b4cc2b015ad428751743ed9e01fc74b54bc295d3ec4edb0bf
crc32: C3751B04
md5: b45cfc7e1519883523ba64530b457cc4
sha1: a6def32fd414313e1d25ea2d38b8bb1971a1dc46
sha256: 010944a97404854b4cc2b015ad428751743ed9e01fc74b54bc295d3ec4edb0bf
sha512: 3bcf2d014431ac56af6ef73cb549b36a98c26be28aba4ac12c00d69551d074a7796ce47923281b2f0b91e56ee84bad4134053b2ca8443cbec28ba9f463040e27
ssdeep: 49152:4VSb+rVVhbUE5gFOKI/N3MOy/dKgcaXdWq4y0yw+9PalFGPSOovE43:4MGbUEN7N3lCHcs74Ww6nPSZE6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T151363A72B605B556D8958F38F4A1F0FCAB531C8C24A1B21E98D93C473BB17C93296D2E
sha3_384: 51a2e158d5ba69910de4fc51086e5abdbc503fa45119f6f03524cc4103818e1b7d57f2e58865f43aded1600bb1ed1092
ep_bytes: ff250020400000000000000000000000
timestamp: 2080-06-05 11:29:34

Version Info:
Translation: 0x0000 0x04b0
Comments: BEST COOKIES LOGS TOOLS
CompanyName: 
FileDescription: BLTools
FileVersion: 1.9.0.0
InternalName: CTools.exe
LegalCopyright: Copyright © 2022
LegalTrademarks: boyring
OriginalFilename: CTools.exe
ProductName: BLTools by boyring
ProductVersion: 1.9.0.0
Assembly Version: 1.9.0.0

IL:Trojan.MSILMamut.51623 also known as:

Lionic	Trojan.Win32.Zilla.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILMamut.51623
FireEye	IL:Trojan.MSILMamut.51623
ALYac	IL:Trojan.MSILMamut.51623
Sangfor	Banker.Win32.Clipbanker.V4t0
CrowdStrike	win/malicious_confidence_70% (W)
Alibaba	TrojanBanker:MSIL/ClipBanker.f3aa60a1
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Clipbanker-9964524-0
Kaspersky	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
BitDefender	IL:Trojan.MSILMamut.51623
Ad-Aware	IL:Trojan.MSILMamut.51623
Emsisoft	IL:Trojan.MSILMamut.51623 (B)
F-Secure	Heuristic.HEUR/AGEN.1232002
VIPRE	IL:Trojan.MSILMamut.51623
TrendMicro	TROJ_GEN.R002C0PGN22
McAfee-GW-Edition	GenericRXTR-AC!B45CFC7E1519
Sophos	Mal/Generic-S
Google	Detected
Avira	HEUR/AGEN.1232002
Antiy-AVL	Trojan/Win32.Sabsik
Microsoft	Trojan:Win32/Tiggre!rfn
Arcabit	IL:Trojan.MSILMamut.DC9A7
ViRobot	Trojan.Win32.Z.Highconfidence.5338112
ZoneAlarm	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
GData	IL:Trojan.MSILMamut.51623
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.C5212842
McAfee	GenericRXTR-AC!B45CFC7E1519
MAX	malware (ai score=89)
Malwarebytes	Spyware.PasswordStealer.MSIL
Panda	Trj/Chgt.AB
TrendMicro-HouseCall	TROJ_GEN.R002C0PGN22
SentinelOne	Static AI – Suspicious PE
Fortinet	PossibleThreat
BitDefenderTheta	Gen:NN.ZemsilF.34606.@p0@a8K9i3c
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen

How to remove IL:Trojan.MSILMamut.51623?

IL:Trojan.MSILMamut.51623 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X