About “MSIL/ClipBanker.GT” infection

The MSIL/ClipBanker.GT is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/ClipBanker.GT virus can do?

Creates RWX memory
Network activity detected but not expressed in API logs
Anomalous binary characteristics
Unusual version info supplied for binary

How to determine MSIL/ClipBanker.GT?


File Info:
crc32: F5A7EA30
md5: 23043620b010d5eb3ffe412162ace27e
name: 23043620B010D5EB3FFE412162ACE27E.mlw
sha1: 2a8503182b66482949d408fbad664271a5bc53ad
sha256: cc099b7accbf06134b294405b746fe22d8611830335231bef35e31116932fc6d
sha512: 815e81ce1655a3a8b9a9eb479a6a2ddce91da0aa000f5aee024f39e63a2de4ebb2bb3875e4a1beade80959ab828ccf727f94d99286507facbe8957724769720d
ssdeep: 96:0uwMtwJ2n6lF+9zGZuIdqdTSPgcVAGECCyOqDIgTOUpfeDgDINzTIMckR6D:0EeSHIdqT3RVyyj2UNPJ3s
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Microsoftxae Windowsxae Operating System $
Assembly Version: 8.5.1.6
InternalName: Cryptocurrencytest.exe
FileVersion: 2.1.6.1
CompanyName: dllhost.exe
LegalTrademarks: COM Surrogate
Comments: COM
ProductName: xa9 Microsoft Corporation. All rights reserved 2018
ProductVersion: 2.1.6.1
FileDescription: Microsoft Corporations
OriginalFilename: Cryptocurrencytest.exe

MSIL/ClipBanker.GT also known as:

K7AntiVirus	Trojan ( 0053c8961 )
Lionic	Trojan.MSIL.Fsysna.4!c
DrWeb	Trojan.MulDrop8.39214
ALYac	Gen:Variant.Ursu.295860
Cylance	Unsafe
Zillya	Trojan.Fsysna.Win32.15900
Sangfor	Trojan.MSIL.Fsysna.gen
Alibaba	Trojan:MSIL/Fsysna.756fab6d
K7GW	Trojan ( 0053c8961 )
Cybereason	malicious.0b010d
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/ClipBanker.GT
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan.MSIL.Fsysna.gen
BitDefender	Gen:Variant.Ursu.295860
NANO-Antivirus	Trojan.Win32.Fsysna.fhqiyi
MicroWorld-eScan	Gen:Variant.Ursu.295860
Tencent	Msil.Trojan.Fsysna.Hnay
Ad-Aware	Gen:Variant.Ursu.295860
Sophos	Mal/Generic-S
Comodo	Malware@#1kfbe66rxlrtw
BitDefenderTheta	Gen:NN.ZemsilCO.34110.am0@aitUT7d
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Ursu.295860
Emsisoft	Gen:Variant.Ursu.295860 (B)
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_97%
Antiy-AVL	Trojan/Generic.ASMalwS.2837DFC
Microsoft	Trojan:MSIL/Upadter.A
GData	Gen:Variant.Ursu.295860
McAfee	Artemis!23043620B010
MAX	malware (ai score=100)
Panda	Trj/GdSda.A
Ikarus	Trojan.MSIL.ClipBanker
Fortinet	MSIL/ClipBanker.GT!tr
AVG	Win32:TrojanX-gen [Trj]

How to remove MSIL/ClipBanker.GT?

MSIL/ClipBanker.GT removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X