Trojan

Should I remove “IL:Trojan.MSILZilla.6974 (B)”?

Malware Removal

The IL:Trojan.MSILZilla.6974 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What IL:Trojan.MSILZilla.6974 (B) virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • At least one IP Address, Domain, or File Name was found in a crypto call
  • Performs HTTP requests potentially not found in PCAP.
  • Enumerates the modules from a process (may be used to locate base addresses in process injection)
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous .NET characteristics

How to determine IL:Trojan.MSILZilla.6974 (B)?



File Info:

name: AE1347686DED9EA5B585.mlw
path: /opt/CAPEv2/storage/binaries/b308c7f8938999d24b30311a59ef04f7459eb5153ad4d1467a4510d912a06461
crc32: 32DCDA93
md5: ae1347686ded9ea5b5853cb692ccd529
sha1: 4d9181b153090d111b4bb190cc28c049dd3afb28
sha256: b308c7f8938999d24b30311a59ef04f7459eb5153ad4d1467a4510d912a06461
sha512: f813673e48502aec0c5a3a2f38a24d19513f45b5b90171980490c7cedcb3df07375b8cf1192ce1db3893f9dfbf17c067086d10eec824dc3e2f66de38e03f8ca4
ssdeep: 3072:jZ0kYStqvo7e7soJnur7xjro3Z8CBFvBUiDYI343aWG3UBssGn4zpNe5Ux9oG:jZ0Nvad0JpBFvKiDs8szpNe5gR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1490413A8772CC38FFE594EB45B34F8E639345B6B10A4D58945C273622F8F3E04B64698
sha3_384: 8a3c6e7fe4b0937da12ba842e33019fb3e598f1e2030fa81251656caed4066ff7ad21d41e9d2652951be9a09d8ceb785
ep_bytes: ff250020400000000000000000000000
timestamp: 2018-09-02 13:38:31


Version Info:

Translation: 0x0000 0x04b0
Comments: qMHAoSzYPEkPmLY
CompanyName: PoRZQjAsJaGXYSw
FileDescription: NnMbEDLZoXrDjQB
FileVersion: 7.6.1.1
InternalName: nnn.exe
LegalCopyright: BnGrYNHZiYqKLMm
OriginalFilename: nnn.exe
ProductName: LtEaGJQAixMHTTj
ProductVersion: 7.6.1.1
Assembly Version: 0.0.0.0

IL:Trojan.MSILZilla.6974 (B) also known as:

LionicTrojan.MSIL.Generic.m!c
Elasticmalicious (high confidence)
MicroWorld-eScanIL:Trojan.MSILZilla.6974
FireEyeGeneric.mg.ae1347686ded9ea5
McAfeeGenericRXFQ-YF!AE1347686DED
CylanceUnsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 005334fc1 )
AlibabaBackdoor:MSIL/Kryptik.9c9618f3
K7GWTrojan ( 005334fc1 )
Cybereasonmalicious.86ded9
CyrenW32/MSIL_Kryptik.CJN.gen!Eldorado
SymantecTrojan.Nancrat
ESET-NOD32a variant of MSIL/Kryptik.OHQ
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Packed.Razy-7544246-0
KasperskyHEUR:Backdoor.MSIL.Generic
BitDefenderIL:Trojan.MSILZilla.6974
NANO-AntivirusTrojan.Win32.Kryptik.fhevnt
AvastWin32:RATX-gen [Trj]
TencentWin32.Trojan.Falsesign.Lndz
Ad-AwareIL:Trojan.MSILZilla.6974
SophosMal/Generic-S
ComodoMalware@#1ip0900tpvczn
DrWebTrojan.PackedNET.165
McAfee-GW-EditionGenericRXFQ-YF!AE1347686DED
EmsisoftIL:Trojan.MSILZilla.6974 (B)
SentinelOneStatic AI – Malicious PE
GDataIL:Trojan.MSILZilla.6974
JiangminBackdoor.MSIL.arjj
AviraTR/Dropper.MSIL.Gen
Antiy-AVLTrojan/Generic.ASMalwS.27EE2AE
MicrosoftTrojan:Win32/Occamy.CB3
CynetMalicious (score: 100)
AhnLab-V3Malware/Win32.RL_Generic.C4357123
BitDefenderThetaGen:NN.ZemsilF.34062.lm1@aCKi8xg
ALYacIL:Trojan.MSILZilla.6974
MAXmalware (ai score=100)
MalwarebytesTrojan.Agent.Gen
YandexTrojan.GenKryptik!i8TnKZ6S3E4
IkarusTrojan.MSIL.Krypt
eGambitPE.Heur.InvalidSig
FortinetMSIL/Kryptik.OHQ!tr
AVGWin32:RATX-gen [Trj]
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_100% (D)
MaxSecureTrojan.Malware.300983.susgen

How to remove IL:Trojan.MSILZilla.6974 (B)?

IL:Trojan.MSILZilla.6974 (B) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment