IL:Trojan.MSILZilla.6264 (B) information

The IL:Trojan.MSILZilla.6264 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What IL:Trojan.MSILZilla.6264 (B) virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Vietnamese
• Authenticode signature is invalid
• Anomalous .NET characteristics
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• CAPE detected the AsyncRat malware family

How to determine IL:Trojan.MSILZilla.6264 (B)?

File Info:
name: C841907008F491DD043A.mlw
path: /opt/CAPEv2/storage/binaries/0c2f4c2c67ea27aa538c9baea8025405ba7dee6397765caadbd16e99e2550cef
crc32: AD038B6C
md5: c841907008f491dd043a56c6843848d7
sha1: 07adab5646d48993a13533fdc9f2d0467dca6d40
sha256: 0c2f4c2c67ea27aa538c9baea8025405ba7dee6397765caadbd16e99e2550cef
sha512: bf9969b96e4822eabe50d6dd77596ad1b2976ce367d8dd4e93c9b38e720a53430cd9a862038fcc738fd0d600b70b4d4a5f99d231eccac3bbae62edf855577da2
ssdeep: 3072:ImSC4peICtp+CsvjZw+HqFXYzQDehBVGjxZT4rtjWwog9JJSh:CCo1C
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T184D34B152600AD9EE894327CC4B62DBD46E8FDF35BB117AEC2E1789A0BBD3B25D4144C
sha3_384: 4d947688bbdcebfd530695c0bc78c9329f08eb653c6fe986fa1493e0a9d6ae3cf3291e3163c449d6311ecea4b761f285
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-12-07 07:22:48

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: test.exe
LegalCopyright:  
OriginalFilename: test.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

IL:Trojan.MSILZilla.6264 (B) also known as:

How to remove IL:Trojan.MSILZilla.6264 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.