What is “Troj/MSIL-REY”?

The Troj/MSIL-REY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Troj/MSIL-REY virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Troj/MSIL-REY?


File Info:
crc32: 558D80E5
md5: 18d193eeb85a6c999247d43de5f8295c
name: 18D193EEB85A6C999247D43DE5F8295C.mlw
sha1: 355eea7fc8a89d38d5dc8e085e7775dc0ef58b78
sha256: 99d023e98d9d7552b73777b1881c96f5b7482f93cf107954ab90319109f0e82f
sha512: 9c6020af729f665303075a97f009d41e32393453c450f6536203a5b43b54ff5120163aa547b83f1b64ef75ad8b65504661fd24a95575d9994f4f79b66cda0801
ssdeep: 192:Zmqr6PJ7++2hZNxyk/VPaKX/0Fo4em27igo/WbxDW0eg+Xg3PKz:ZTrs7++AnzPRXcFo4eV6TUK
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright:  
Assembly Version: 0.0.0.0
InternalName: E86C1ED56A87E54537C007A4CF9.exe
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
FileDescription:  
OriginalFilename: E86C1ED56A87E54537C007A4CF9.exe

Troj/MSIL-REY also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.RedLine.20
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.MsilFC.S16692016
ALYac	Gen:Variant.Bulz.168834
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.eb85a6
Cyren	W32/MSIL_Troj.XK.gen!Eldorado
ESET-NOD32	a variant of MSIL/ClipBanker.PK
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Packed.Clipbanker-9802325-0
Kaspersky	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
BitDefender	Gen:Variant.Bulz.168834
MicroWorld-eScan	Gen:Variant.Bulz.168834
Ad-Aware	Gen:Variant.Bulz.168834
Sophos	Troj/MSIL-REY
F-Secure	Heuristic.HEUR/AGEN.1137914
BitDefenderTheta	Gen:NN.ZemsilF.34722.am0@aCWFjje
McAfee-GW-Edition	PWS-FCOC!18D193EEB85A
FireEye	Generic.mg.18d193eeb85a6c99
Emsisoft	Gen:Variant.Bulz.168834 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Banker.MSIL.cko
Avira	HEUR/AGEN.1137914
Microsoft	Trojan:MSIL/Clipper.AB!MTB
ZoneAlarm	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
GData	Gen:Variant.Bulz.168834
AhnLab-V3	Malware/Win32.RL_Generic.C4203768
McAfee	PWS-FCOC!18D193EEB85A
MAX	malware (ai score=80)
Malwarebytes	Trojan.ClipBanker.Generic
Rising	Spyware.ClipBanker!1.D05B (CLASSIC)
Ikarus	Trojan.MSIL.ClipBanker
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/ClipBanker.PK!tr
AVG	Win32:TrojanX-gen [Trj]

How to remove Troj/MSIL-REY?

Troj/MSIL-REY removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X