How to remove “MSIL/TrojanDownloader.Small.CTS”?

The MSIL/TrojanDownloader.Small.CTS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/TrojanDownloader.Small.CTS virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with Confuser
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine MSIL/TrojanDownloader.Small.CTS?


File Info:
name: 2B7654930FA23F39CDB9.mlw
path: /opt/CAPEv2/storage/binaries/fdddef3747b982398998af1f2225691a450e275caad31b228246dfee2649eb65
crc32: D09338C4
md5: 2b7654930fa23f39cdb96f5135c1f8a9
sha1: 06eae1b5fd69587c6715b0cdaa46dbf020eed9f4
sha256: fdddef3747b982398998af1f2225691a450e275caad31b228246dfee2649eb65
sha512: 009eb3b2a51189d3325326b598cdfe0c2e17b1ca748abb72c4f9dc3b2b582d68089623bd1f4bf4c5a8dc5f5154ecb0d46b6f54e956ee62de79d06c8164314a1c
ssdeep: 3072:2fRZ62WTOb/43PEXDMDrpemgKvK8O+XICaRP2lTZ:2fRbWT6/438TMDrZxvlIDqT
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13F14F6E3228FF249F01110B1D9F516F34977AD13CF02962BA541BFBEF53855AA62321A
sha3_384: 48434b4c6f782a393e4399f6ba8bfcf7bd8c446dcaeca2ad814f2e90128b3bf91fd41192fd11c35f3fa503b28c012620
ep_bytes: ff250020400000000000000000000000
timestamp: 2054-03-13 16:29:18

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: MyApp
FileVersion: 1.0.0.0
InternalName: Yahoo mail.exe
LegalCopyright: Copyright ©  2022
LegalTrademarks: 
OriginalFilename: Yahoo mail.exe
ProductName: MyApp
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/TrojanDownloader.Small.CTS also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.MSIL.PixelJect.4!c
FireEye	Generic.mg.2b7654930fa23f39
McAfee	Artemis!2B7654930FA2
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Small.CTS
APEX	Malicious
Kaspersky	HEUR:Trojan.MSIL.PixelJect.gen
Alibaba	Trojan:MSIL/PixelJect.2bdf3ccd
Rising	Trojan.Generic/MSIL@AI.90 (RDM.MSIL:nopABi7W71G2U8bpsUBBhQ)
DrWeb	Trojan.DownloaderNET.338
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.MSIL.PixelJect.gen
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.34606.mm0@ayftckl
Malwarebytes	Generic.Malware/Suspicious
Tencent	Msil.Trojan.Pixelject.Hsss
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware [Misc]
Avast	FileRepMalware [Misc]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove MSIL/TrojanDownloader.Small.CTS?

MSIL/TrojanDownloader.Small.CTS removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X