Trojan.MSIL.DOTHETUK.rmo (file analysis)

The Trojan.MSIL.DOTHETUK.rmo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.MSIL.DOTHETUK.rmo virus can do?

Authenticode signature is invalid

How to determine Trojan.MSIL.DOTHETUK.rmo?


File Info:
name: 2D5708201FD31DC2BA1A.mlw
path: /opt/CAPEv2/storage/binaries/5bd6a244fa6d1fef7d984e1d1c67d9e059608fa09c1b753b8ab7b9d58c6fce15
crc32: DACA7BD1
md5: 2d5708201fd31dc2ba1a246d22c9274c
sha1: 0aaf9eba16db692df72527b0e1c6a988291844c5
sha256: 5bd6a244fa6d1fef7d984e1d1c67d9e059608fa09c1b753b8ab7b9d58c6fce15
sha512: 514d21bd66fb47fb0758a5d3edd900e6d915b6db6dab07572d588b94a4ad33fc437bc87cfe0307bfa32d04f7b42d48094df2dbc601006d0a8ec77969df0e33d9
ssdeep: 3072:LCw+KVeWN+gvg3jECFwPBdGVMYtqOXUoVsGxBuVzvraX:LKKwdlzhFwPBPoVzxIz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T140D37D4BFB04A76BC63B2733C8B25DBC42E5D6662B42EB1F80E466385B733DC5A01654
sha3_384: 628d434863cee597b2ebbfb6f328bf99b4b94eb13f90ba4d3a9c0b7af5425c694962632ec0e2e95daa10485ec571a5ca
ep_bytes: ff250020400000000000000000000000
timestamp: 2016-11-18 13:51:53

Version Info:
Translation: 0x0000 0x04b0
Comments: RPX 1.3.4400.61



FileDescription:  
FileVersion: 1.0.0.0
InternalName: Explorer666.exe
LegalCopyright:  
OriginalFilename: Explorer666.exe
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan.MSIL.DOTHETUK.rmo also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.lIZK
MicroWorld-eScan	Gen:Heur.Mint.Packer.8
FireEye	Generic.mg.2d5708201fd31dc2
ALYac	Gen:Heur.Mint.Packer.8
Cylance	Unsafe
VIPRE	Gen:Heur.Mint.Packer.8
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 00528cb81 )
Alibaba	Trojan:MSIL/DOTHETUK.f690a323
K7GW	Trojan ( 00528cb81 )
Cybereason	malicious.01fd31
VirIT	Trojan.Win32.Injekt.HNH
Cyren	W32/MSIL_Troj.DZ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.UBF
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 99)
Kaspersky	Trojan.MSIL.DOTHETUK.rmo
BitDefender	Gen:Heur.Mint.Packer.8
NANO-Antivirus	Trojan.Win32.Kryptik.eykmwh
Avast	Win32:RATX-gen [Trj]
Tencent	Msil.Trojan.Dothetuk.Hsst
Ad-Aware	Gen:Heur.Mint.Packer.8
Emsisoft	Gen:Heur.Mint.Packer.8 (B)
Comodo	TrojWare.MSIL.Zapchast.IW@7k7mpi
DrWeb	Trojan.Inject.5077
Zillya	Trojan.Kryptik.Win32.3056380
TrendMicro	TROJ_GEN.R002C0PHP22
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
GData	Gen:Heur.Mint.Packer.8
Avira	TR/Dropper.MSIL.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.4BB3
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Arcabit	Trojan.Mint.Packer.8
Microsoft	Backdoor:MSIL/Bladabindi
Google	Detected
Acronis	suspicious
McAfee	Generic.dps
MAX	malware (ai score=98)
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:3h3Fg5/Gt9UHFWt3XX0Y7w)
Ikarus	Trojan.MSIL.MultiPacked
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.RV!tr
BitDefenderTheta	Gen:NN.ZemsilF.34606.im0@aaFqUgd
AVG	Win32:RATX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan.MSIL.DOTHETUK.rmo?

Trojan.MSIL.DOTHETUK.rmo removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X