Should I remove “Trojan.Mamson”?

The Trojan.Mamson is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Mamson virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Authenticode signature is invalid

How to determine Trojan.Mamson?


File Info:
name: B96BE92347DCC152F06E.mlw
path: /opt/CAPEv2/storage/binaries/7bde6fb6b74269dbb2c83bd176b44c8b01f7c736892cd12fc41416516f5568c0
crc32: 371EFA22
md5: b96be92347dcc152f06e89e3c8025f97
sha1: 5a8302fd9481c087c13f4e6ae929f7c1f3022a44
sha256: 7bde6fb6b74269dbb2c83bd176b44c8b01f7c736892cd12fc41416516f5568c0
sha512: 83182b0ec106ec7f54de9bb5add97b38f8264899d2e285537cf5f474ea66f282201a7f6b07a4a3cf73bd8f5b45afbf994c08216350df153f406babe41a00f753
ssdeep: 98304:CoYhoxJHVc5VwCZuhxO2/jsaHjLyufIaEcSqZ0I6T8/FeMCI:CoYh4J1KjO/jsEyu3SJIp/F
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1064623771676004DE4D5CC3A8A277DE131FA236B8A82B8B4B5EB69C136624E0F353D17
sha3_384: 47dc8020c8ddc16f10bed3ca150d3ea55b24cdf4ddd1ecc635ab62bf4a7d28d89277a9d40e7c3bde5e9215f98b0d83f5
ep_bytes: 6857c1e6ffe89ea6f1ff03f1e9cbfffb
timestamp: 2021-11-22 07:27:00

Version Info:
0: [No Data]

Trojan.Mamson also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.38163258
FireEye	Generic.mg.b96be92347dcc152
CAT-QuickHeal	Trojan.Mamson
McAfee	Artemis!B96BE92347DC
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	Packed:Win32/VMProtect.ab4b93b5
K7GW	Trojan ( 7000001c1 )
K7AntiVirus	Trojan ( 7000001c1 )
BitDefenderTheta	Gen:NN.ZexaF.34062.@FW@aStzaqci
Cyren	W32/Zusy.HP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.VMProtect.AR suspicious
TrendMicro-HouseCall	TROJ_GEN.R002C0RKR21
Paloalto	generic.ml
ClamAV	Win.Malware.Vmprotbad-9855134-0
BitDefender	Trojan.GenericKD.38163258
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.38163258
Emsisoft	Trojan.GenericKD.38163258 (B)
Comodo	ApplicUnwnt@0
TrendMicro	TROJ_GEN.R002C0RKR21
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Sophos	Mal/Generic-R + Mal/VMProtBad-A
Ikarus	Trojan.Win32.VMProtBad
GData	Trojan.GenericKD.38163258
Avira	HEUR/AGEN.1145252
Antiy-AVL	Trojan/Generic.ASMalwS.34DA765
Gridinsoft	Ransom.Win32.Sabsik.sa
Microsoft	Trojan:Win32/Mamson.A!ac
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Reputation.C4398773
ALYac	Trojan.GenericKD.38163258
MAX	malware (ai score=85)
Cylance	Unsafe
APEX	Malicious
Rising	Trojan.Generic@ML.94 (RDMK:7XNrVsujBArN+n0ga5XXOQ)
Yandex	Riskware.VMProtect!8nwgO+XONIw
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.ADER!tr
AVG	Win32:Malware-gen
Cybereason	malicious.347dcc
Panda	Trj/CI.A

How to remove Trojan.Mamson?

Trojan.Mamson removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X