Malware

MSIL:GenMalicious-DTX [Trj] removal tips

Malware Removal

The MSIL:GenMalicious-DTX [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What MSIL:GenMalicious-DTX [Trj] virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Behavioural detection: Executable code extraction – unpacking
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • Enumerates the modules from a process (may be used to locate base addresses in process injection)
  • Reads data out of its own binary image
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid

How to determine MSIL:GenMalicious-DTX [Trj]?



File Info:

name: 2B3BF1EB39EEE541A04F.mlw
path: /opt/CAPEv2/storage/binaries/6f91e5b4fce719532c1116d152fe5b839065790ff3ea27ea57752bb0827f03c7
crc32: 64DD0898
md5: 2b3bf1eb39eee541a04f4335f265ad75
sha1: 6a2f3c80424c5a5c0ff4de6c1d7ace189eec7960
sha256: 6f91e5b4fce719532c1116d152fe5b839065790ff3ea27ea57752bb0827f03c7
sha512: cfdc2182ba132af4d5be3a28f5ee2f16bbd29bf89ecf14b372864b90434b1d77e35b0a395c18c27e83654af1e6d13d304d91bd53f9fe27ddaa2dba6b1432c8a0
ssdeep: 3072:+iafDPT96LT80uZB0/d2bRO3IPbtdsbE:N8t0l2YYP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F9E33B287BE44E15E5BF1EB6047152100B79FA179A07D74E0EF068EA2D337818F4A7A3
sha3_384: e72542fba7a6e977ffc86b9e70e3b3b00ed4bfdc05e312492e8de1f1534994c11e6ec5f4997c8ae201fe4671b5e0c4af
ep_bytes: ff250020400000000000000000000000
timestamp: 2016-02-01 00:02:59


Version Info:

Translation: 0x0000 0x04b0
FileDescription: Server
FileVersion: 1.0.0.0
InternalName: Stub.exe
LegalCopyright: Copyright ©  2012
OriginalFilename: Stub.exe
ProductName: Server
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL:GenMalicious-DTX [Trj] also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanIL:Trojan.MSILZilla.4705
FireEyeGeneric.mg.2b3bf1eb39eee541
ALYacIL:Trojan.MSILZilla.4705
MalwarebytesBackdoor.Bladabindi
SangforSuspicious.Win32.Save.a
BitDefenderIL:Trojan.MSILZilla.4705
CrowdStrikewin/malicious_confidence_100% (D)
BitDefenderThetaAI:Packer.FAB2C2D51F
ESET-NOD32a variant of MSIL/Bladabindi.AT
APEXMalicious
ClamAVWin.Packed.Zusy-7753321-0
KasperskyHEUR:Trojan.Win32.Generic
NANO-AntivirusTrojan.Win32.Agent.dklhri
AvastMSIL:GenMalicious-DTX [Trj]
RisingBackdoor.Njrat!1.9E49 (CLASSIC)
Ad-AwareIL:Trojan.MSILZilla.4705
SophosML/PE-A + Mal/SpyGate-A
DrWebTrojan.PWS.StealerNET.9
McAfee-GW-EditionArtemis!Trojan
EmsisoftIL:Trojan.MSILZilla.4705 (B)
IkarusTrojan.MSIL.Janeleiro
AviraTR/Dropper.Gen
MAXmalware (ai score=82)
Antiy-AVLTrojan/Generic.ASMalwS.16E8532
SUPERAntiSpywareTrojan.Agent/Gen-Zusy
GDataMSIL.Trojan-Spy.Keylogger.I
CynetMalicious (score: 99)
McAfeeArtemis!2B3BF1EB39EE
CylanceUnsafe
TencentMalware.Win32.Gencirc.114c388f
YandexTrojan.Agent!hH9LUVSJrYI
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/SpyPSW.AVQ!tr
Cybereasonmalicious.b39eee
PandaTrj/GdSda.A

How to remove MSIL:GenMalicious-DTX [Trj]?

MSIL:GenMalicious-DTX [Trj] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment