Trojan.MsilFC.S18894616 (file analysis)

The Trojan.MsilFC.S18894616 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.MsilFC.S18894616 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
.NET file is packed/obfuscated with SmartAssembly
Authenticode signature is invalid
Network activity detected but not expressed in API logs

How to determine Trojan.MsilFC.S18894616?


File Info:
name: C1E98F2C866BC6078B05.mlw
path: /opt/CAPEv2/storage/binaries/88d86015852612817fbb087f2e85b64de4470c120a98f8c6d2227307cdb24aa4
crc32: 4B378EB2
md5: c1e98f2c866bc6078b0536137d1f43a4
sha1: 9acf0592a232f8013c850eb99f9dbebf17cd2225
sha256: 88d86015852612817fbb087f2e85b64de4470c120a98f8c6d2227307cdb24aa4
sha512: 2bc7963b0fe0915e4c1e9de1cb615728736d9b5f65c4ac90aae40fc4fda213bf504120af57511282a30caf98010ac7986f06482ab9ec40e27254e7a706d43ecb
ssdeep: 768:15eSeLnPvcjG1af/m612G0BJXIQ9E40QgnfseaYbj9f7XTQ94gXy:15lwvqcaf/m9JYLnfH5bjZLTQqUy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CB532A5C039C7B83DAE90D7A45D276680334E15B5F47EB1FB99403B699223CF8462E8B
sha3_384: 090e947ab7dd6d73300522cccb6ed8b1f019b119ae54da2503240c3a4d38de2721ee5d6e33d50cb4e3c057587121c45b
ep_bytes: ff25002040000000000000000000
timestamp: 2021-01-09 03:29:56

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: lol.exe
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: lol.exe
ProductName: 
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Trojan.MsilFC.S18894616 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.MSIL.Bladabindi.1
CAT-QuickHeal	Trojan.MsilFC.S18894616
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_80% (D)
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Cyren	W32/MSIL_Agent.BRH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Spy.Agent.CZU
APEX	Malicious
ClamAV	Win.Malware.Msilheracles-9801549-0
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender	Gen:Heur.MSIL.Bladabindi.1
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.10ce32ff
Ad-Aware	Gen:Heur.MSIL.Bladabindi.1
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.PWS.Stealer.29796
VIPRE	Trojan.Win32.Generic!BT
FireEye	Generic.mg.c1e98f2c866bc607
Emsisoft	Gen:Heur.MSIL.Bladabindi.1 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Heur.MSIL.Bladabindi.1
Jiangmin	Trojan.PSW.MSIL.bdng
Avira	TR/Redcap.tvoss
Antiy-AVL	Trojan/Generic.ASMalwS.3135464
Microsoft	Backdoor:Win32/Bladabindi!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Gen.RL_Reputation.C4301829
VBA32	TScope.Trojan.MSIL
MAX	malware (ai score=81)
Malwarebytes	Spyware.TelegramBot
Yandex	Trojan.Redcap!+1nSEP7wGrw
Ikarus	Gen.MSIL.Bladabindi
eGambit	Unsafe.AI_Score_96%
BitDefenderTheta	Gen:NN.ZemsilF.34294.dm1@ayGNrNf
AVG	Win32:Malware-gen
Cybereason	malicious.c866bc
Panda	Trj/GdSda.A
MaxSecure	Trojan.Malware.74396735.susgen

How to remove Trojan.MsilFC.S18894616?

Trojan.MsilFC.S18894616 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X