Spy

MSIL/Spy.RedLine.B removal tips

Malware Removal

The MSIL/Spy.RedLine.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL/Spy.RedLine.B virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • CAPE extracted potentially suspicious content
  • .NET file is packed/obfuscated with Confuser
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine MSIL/Spy.RedLine.B?



File Info:

name: F2746F03C5BD529D21B3.mlw
path: /opt/CAPEv2/storage/binaries/fda2b61b0289b4319985e179160a55219b6350c39947a25d6af1ec5a3151f14f
crc32: 2F7AD536
md5: f2746f03c5bd529d21b3bc4d2c48ce17
sha1: 106a72462df2a241b868ead1cc7d070dde98c741
sha256: fda2b61b0289b4319985e179160a55219b6350c39947a25d6af1ec5a3151f14f
sha512: a3ff52783e0e4e7036e1dcd0804a628be7f7b73204241662933034b1ec7544742bf42b13d941bef7c2d3965f8832c2d3ec635d59ab89c03c3bd6c918759db420
ssdeep: 24576:CD6EEO0mbbNLQhvr8APrC+AMxzRIBQFEzSPVxyc5Lwo2:BEzfQ5rHPuMUBQeQ2SB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A83523657062E11FC017D0328A958DB85BF5BA13CA83D2766D5703C73B1CBE29E09AF6
sha3_384: 80d96b4ce17dda2009a0186f0be1dac72ef8609c7a38615732ebb048dad649521d4e34a0645040db0c60d4ad61ded9ac
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-10-10 10:55:50


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: Google Updater
FileVersion: 1.0.0.0
InternalName: gilrfdir5l7gse.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: gilrfdir5l7gse.exe
ProductName: Google Updater
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Spy.RedLine.B also known as:

BkavW32.AIDetectNet.01
MicroWorld-eScanGen:Trojan.Mardom.MN.14
ALYacGen:Trojan.Mardom.MN.14
MalwarebytesTrojan.Crypt.MSIL
VIPREGen:Trojan.Mardom.MN.14
Cybereasonmalicious.62df2a
CyrenW32/MSIL_Kryptik.IBY.gen!Eldorado
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Spy.RedLine.B
APEXMalicious
CynetMalicious (score: 100)
BitDefenderGen:Trojan.Mardom.MN.14
AvastWin32:MiscX-gen [PUP]
Ad-AwareGen:Trojan.Mardom.MN.14
EmsisoftGen:Trojan.Mardom.MN.14 (B)
McAfee-GW-EditionBehavesLike.Win32.AgentTesla.tc
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.f2746f03c5bd529d
SophosGeneric ML PUA (PUA)
SentinelOneStatic AI – Malicious PE
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
ArcabitTrojan.Mardom.MN.14
GDataGen:Trojan.Mardom.MN.14
GoogleDetected
AhnLab-V3Trojan/Win.Mardom.C5242662
Acronissuspicious
MAXmalware (ai score=81)
CylanceUnsafe
RisingTrojan.Generic/MSIL@AI.97 (RDM.MSIL:0vmecVa85Edao6QYswuS/Q)
IkarusTrojan.Inject
BitDefenderThetaGen:NN.ZemsilF.34726.en0@aum42bo
AVGWin32:MiscX-gen [PUP]
CrowdStrikewin/malicious_confidence_60% (D)

How to remove MSIL/Spy.RedLine.B?

MSIL/Spy.RedLine.B removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment